diff --git a/docusaurus/docs/cms/configurations/admin-panel.md b/docusaurus/docs/cms/configurations/admin-panel.md
index 3800250d02..0923743144 100644
--- a/docusaurus/docs/cms/configurations/admin-panel.md
+++ b/docusaurus/docs/cms/configurations/admin-panel.md
@@ -346,7 +346,7 @@ To configure HTTP cookies for admin authentication, use the following parameters
 | `auth.cookie`                     | Cookie configuration for admin authentication                                                                                                                                                      | object        | `{}`                                                                                                                                |
 | `auth.cookie.name`                | Name of the admin access-token cookie. The value is trimmed and validated against RFC 6265 cookie-name characters. Invalid values fall back to the default.                                        | string        | `'jwtToken'`                                                                                                                        |
 | `auth.cookie.domain`              | Cookie domain (inherits from server if not set)                                                                                                                                                   | string        | `undefined`                                                                                                                         |
-| `auth.cookie.path`                | Cookie path                                                                                                                                                                                        | string        | `'/admin'`                                                                                                                          |
+| `auth.cookie.path`                | Path for admin authentication cookies. When unset, the access-token cookie derives from `admin.url` so the panel reads it; the refresh cookie stays at `/admin` for the auth endpoints. When set, applies to both cookies. Both include any `server.url` subpath. A configured path not covering the admin API is ignored for the refresh cookie with a warning. | string        | `undefined` (auto-derives from `admin.url`)                                                                                                                          |
 | `auth.cookie.sameSite`            | <ExternalLink to="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value" text="SameSite cookie attribute"/>                                                                                                                                                                          | string        | `'lax'`                                                                                                                             |
 | `auth.cookie.secure`              | Whether the `Secure` attribute is set on the admin authentication cookie. When unset, it is enabled automatically in production over HTTPS; setting it to `false` in production logs a warning.       | boolean       | `undefined`                                                                                                                         |