diff --git a/lib/krb5/krb5.conf.5 b/lib/krb5/krb5.conf.5
index b03e2aaf5..bb2e61d88 100644
--- a/lib/krb5/krb5.conf.5
+++ b/lib/krb5/krb5.conf.5
@@ -816,6 +816,8 @@ enabled by default for now.
 Enable unarmored encrypted timestamp pre-authentication.
 Enabled by default for now, but in a future release will be
 disabled.
+.It Li enable-pkinit = Va BOOL
+Enable PKINIT (disabled by default).
 .It Li allow-anonymous = Va BOOL
 If the kdc is allowed to hand out anonymous tickets.
 .It Li synthetic_clients = Va BOOL