diff --git a/smf/switch_zone_setup/README.md b/smf/switch_zone_setup/README.md
new file mode 100644
index 0000000000..48c0403fef
--- /dev/null
+++ b/smf/switch_zone_setup/README.md
@@ -0,0 +1,4 @@
+`authorized_keys` is from [`oxidecomputer/support-piv-tokens@36abeb82`](https://github.com/oxidecomputer/support-piv-tokens/blob/36abeb82aacb3640be2f6c988e49844356cf65a8/authorized_keys).
+
+If the set of authorized keys changes, it should also be updated in Hubris
+(`support/support_tokens/authorized_keys`)