diff --git a/apps/docs/content/self-hosting/manage/production.mdx b/apps/docs/content/self-hosting/manage/production.mdx
index 6d9e6bdcf..d082e33d4 100644
--- a/apps/docs/content/self-hosting/manage/production.mdx
+++ b/apps/docs/content/self-hosting/manage/production.mdx
@@ -201,8 +201,7 @@ DefaultInstance:
 
 ## Limits and Quotas
 
-If you host ZITADEL as a service,
-you might want to [limit usage and/or execute tasks on certain usage units and levels](/self-hosting/manage/usage_control).
+We strongly advise implementing [rate limiting](/self-hosting/manage/usage_control) and bot detection. Even with robust cryptography, reducing request volume helps protect against brute-force and denial-of-service attacks.
 
 ## Minimum system requirements
 
diff --git a/apps/docs/content/self-hosting/manage/productionchecklist.mdx b/apps/docs/content/self-hosting/manage/productionchecklist.mdx
index 17f889072..ead8bcd2f 100644
--- a/apps/docs/content/self-hosting/manage/productionchecklist.mdx
+++ b/apps/docs/content/self-hosting/manage/productionchecklist.mdx
@@ -34,7 +34,8 @@ To apply best practices to your production setup we created a step by step check
 
 - [ ] Use a Layer 7 Web Application Firewall to secure ZITADEL that supports **[HTTP/2](/self-hosting/manage/http2)**
   - [ ] Limit the access by IP addresses if needed
-  - [ ] Secure the access by rate limits for specific endpoints (e.g. API vs frontend) to secure availability on high load. See the [ZITADEL Cloud rate limits](/legal/policies/rate-limit-policy) for reference.
+  - [ ] Implement rate limiting for specific endpoints (e.g. API vs frontend) to protect against brute-force and denial-of-service attacks. See the [ZITADEL Cloud rate limits](/legal/policies/rate-limit-policy) for reference.
+  - [ ] Implement bot detection to reduce automated abuse
   - [ ] Check that your firewall also filters IPv6 traffic
 
 ### ZITADEL setup