diff --git a/src/frontend/src/content/docs/app-host/typescript-apphost.mdx b/src/frontend/src/content/docs/app-host/typescript-apphost.mdx
index 09e6b40f8..f1c358b58 100644
--- a/src/frontend/src/content/docs/app-host/typescript-apphost.mdx
+++ b/src/frontend/src/content/docs/app-host/typescript-apphost.mdx
@@ -416,6 +416,12 @@ aspire certs trust
   ```
 </Aside>
 
+### Trusting the certificate for outbound TLS connections
+
+When your AppHost code opens TLS connections to Aspire-managed resources at runtime (for example, connecting directly to the dashboard's OTLP endpoint from custom AppHost logic), the Aspire CLI ensures Node.js trusts the same development certificate that the Developer Control Plane (DCP) uses. The CLI exports the trusted development certificate into a content-addressed PEM cache under the Aspire home directory (`ASPIRE_HOME`), and Node.js is configured to trust that bundle through the `NODE_EXTRA_CA_CERTS` environment variable.
+
+If you've already set `NODE_EXTRA_CA_CERTS` for your own certificates, the CLI preserves your value by generating a combined bundle that includes both your certificates and the Aspire development certificate, rather than overwriting your setting.
+
 <LearnMore>
   See [Certificate configuration](/app-host/certificate-configuration/) for details
   on HTTPS certificate management in Aspire, including Linux-specific setup.