diff --git a/faq/faq.md b/faq/faq.md
index 2ad79cfa..9e278c2d 100644
--- a/faq/faq.md
+++ b/faq/faq.md
@@ -3,6 +3,8 @@ title: FAQ
 description: "Frequently asked questions"
 ---
 
+import WorkingDirConfigNotice from "/snippets/cli-working-dir-config-notice.mdx";
+
 <AccordionGroup>
 
 <Accordion title="Where can I find API documentation?">
@@ -53,7 +55,9 @@ When calling a Kosli command you can skip the file extension. For example, to li
 kosli list environments --config-file kosli-conf
 ```
 
-`--config-file` defaults to `kosli`, so if you name your file `kosli.<yaml|toml|json>` and the file is in the same location as where you run Kosli commands from, you can skip the `--config-file` altogether.
+`--config-file` defaults to `$HOME/.kosli.yml`, which is the file [`kosli config`](/client_reference/kosli_config) writes. Any other config file has to be named explicitly, either with `--config-file` on each command or by setting `KOSLI_CONFIG_FILE` in the environment.
+
+<WorkingDirConfigNotice />
 </Accordion>
 
 <Accordion title="Reporting the same artifact and evidence multiple times">
diff --git a/getting_started/install.md b/getting_started/install.md
index 75a25f15..11d6c17d 100644
--- a/getting_started/install.md
+++ b/getting_started/install.md
@@ -6,6 +6,8 @@ description: "Instructions to install Kosli CLI on various platforms"
 icon: "download"
 ---
 
+import WorkingDirConfigNotice from "/snippets/cli-working-dir-config-notice.mdx";
+
 <Steps>
   <Step title="Choose your installation method">
 
@@ -165,7 +167,9 @@ Each key in the config file corresponds to the flag name, capitalized. For insta
 
 Config files can be written in JSON, YAML, or TOML formats.
 
-To direct Kosli CLI to use a config file, employ the --config-file flag when executing Kosli commands. By default, the CLI looks for a config file called `kosli.<yaml/yml/json/toml>`
+To direct Kosli CLI to use a config file, employ the `--config-file` flag when executing Kosli commands, or set `KOSLI_CONFIG_FILE` in the environment. By default the CLI reads `$HOME/.kosli.yml`, the file [`kosli config`](/client_reference/kosli_config) writes; a config file anywhere else has to be named.
+
+<WorkingDirConfigNotice />
 
 Below are examples of different config file formats:
 
diff --git a/snippets/cli-working-dir-config-notice.mdx b/snippets/cli-working-dir-config-notice.mdx
new file mode 100644
index 00000000..59a23b81
--- /dev/null
+++ b/snippets/cli-working-dir-config-notice.mdx
@@ -0,0 +1,3 @@
+<Warning>
+Up to CLI v2.39.2, a file named `kosli.<yaml|yml|json|toml>` in the directory you ran Kosli from was loaded automatically, without `--config-file`. That is no longer the case, because it let the contents of a repository decide where the CLI sent your API token. If you relied on it, name your config file explicitly with `--config-file` on each command, or set `KOSLI_CONFIG_FILE` to its path. To apply its settings to every command instead, move them to your home config file with [`kosli config`](/client_reference/kosli_config). From v2.40.0 the CLI warns when it finds such a file and is ignoring it, unless you pass `--quiet`.
+</Warning>