diff --git a/modules/keycloak.nix b/modules/keycloak.nix
index 8c101f0..08d5d2d 100644
--- a/modules/keycloak.nix
+++ b/modules/keycloak.nix
@@ -6,6 +6,7 @@ in
   sops.secrets."keycloak/db" = { };
   services.keycloak = {
     enable = true;
+    # we use unstable as the release in stable is insecure
     package = nixpkgs-unstable.legacyPackages.x86_64-linux.keycloak;
     settings = {
       http-port = 8086;