diff --git a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
index 35ceefda..591dfe8b 100644
--- a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
+++ b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
@@ -167,6 +167,8 @@ server:
     redisAddr: "redis://redis.example.com:6379"
 ```
 
+If your NATS cluster uses TLS, as in the High Availability guide's [NATS example](/selfhosted/maintenance/scaling/high-availability#example-a-self-hosted-cluster-with-docker-compose), write each URL with `tls://` and the client password. If its certificates come from your own CA, also add the CA to the `netbird-server` volumes in `docker-compose.yml` as that example shows, and run `docker compose up -d netbird-server` instead of the restart below.
+
 Restart the server:
 
 ```bash
@@ -296,7 +298,7 @@ From here on, TLS and routing move from the installer's Traefik to your load bal
      netbird_data:
    ```
 
-   Keep the installer's `.env` beside it: it supplies the domain, image tags and license key.
+   Keep the installer's `.env` beside it: it supplies the domain, image tags and license key. If you added a NATS CA to the volumes in Step 2, add the same line here.
 
    Before you start the node, change its rules at a network firewall or cloud security group:
 
@@ -359,7 +361,7 @@ Node 2 runs the same three files as node 1, with no installer and no database of
 
    Node 1 keeps running: these tags name the images it already runs. It switches to them in item 4.
 
-2. On node 2, create the same directory and copy three files into it from node 1: `config.yaml`, `.env` and `docker-compose.yml`. Two of them hold secrets, so copy them over an encrypted channel, such as `scp` or your configuration management tool's secret store, and keep them readable by root only:
+2. On node 2, create the same directory and copy three files into it from node 1: `config.yaml`, `.env` and `docker-compose.yml`, plus `nats-ca.pem` if you added a NATS CA in Step 2. Two of them hold secrets, so copy them over an encrypted channel, such as `scp` or your configuration management tool's secret store, and keep them readable by root only:
 
    ```bash
    chmod 600 config.yaml .env