diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 69558ac85c..e1fec3d7a8 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -1402,7 +1402,51 @@
Equivalent to .
+
+
+ Credentials
+
+
+
+ ID:PATH
+ ID:VALUE
+
+ Pass a credential to the container. These two options correspond to the
+ LoadCredential= and SetCredential= settings in unit files. See
+ systemd.exec5 for
+ details about these concepts, as well as the syntax of the option's arguments.
+
+ Note:
+
+
+ When systemd-nspawn runs as systemd system service it can make
+ use and propagate credentials it received via
+ LoadCredential=/SetCredential= to the container
+ payload.
+
+ A systemd service manager running as PID 1 in the container can make use of
+ credentials passed in this way, and propagate them further to services it itself
+ runs.
+
+
+ Thus it is possible to easily propagate credentials from a host service manager to a
+ systemd-nspawn service and from there into its payload and services running within
+ it.
+
+ In order to embed binary data into
+ the credential data for use C-style escaping
+ (i.e. \n to embed a newline, or \x00 to embed a NUL byte. Note
+ that the invoking shell might already apply unescaping once, hence this might require double
+ escaping!).
+
+
+
+
+
+ Other
+
+