diff --git a/docs/admin/06_storage.rst b/docs/admin/06_storage.rst
index 4466e30a675551b077b99f6ce3b7caefaf908db2..96b789b36d30e7d0014bc19df091b86d1433118a 100644
--- a/docs/admin/06_storage.rst
+++ b/docs/admin/06_storage.rst
@@ -1,10 +1,30 @@
 Storage
 =======
 
+AlekSIS needs a writable storage, both for media files (pictures,
+generated PDF files, and the like), and to store generated frontend
+assets like the themed CSS stylesheet.
+
+.. note::
+    Everything except this media storage can be mounted and used
+    entirely read-only, i.e. to keep the AlekSIS installation immutable.
+
+Local filesystem storage
+------------------------
+
+By default, the media storage resides in the local filesystem, in the
+location defined in the ``static.root`` configuration key.
+
+.. warning::
+    Do not expose the media storage directly through a webserver.
+    AlekSIS uses a specially protected storage framework that
+    employs cryptographic tokens to protect user data from URL
+    guessing.
+
 Amazon S3 (or other S#-compatible storage)
 ------------------------------------------
 
-AlekSIS allows you to configure an Amazon S3 endpoint for static and media
+AlekSIS allows you to configure an Amazon S3 endpoint for  media
 files. This is useful e.g. for loadbalancing with multiple AlekSIS
 instances.