diff --git a/docs/build/guides/testing/test-contract-auth.mdx b/docs/build/guides/testing/test-contract-auth.mdx
index 522c0a49e7..17f8cec910 100644
--- a/docs/build/guides/testing/test-contract-auth.mdx
+++ b/docs/build/guides/testing/test-contract-auth.mdx
@@ -58,3 +58,15 @@ fn test() {
 For the full example the above snippet is extracted from, see the [auth example contract](../../smart-contracts/example-contracts/auth.mdx).
 
 :::
+
+## Authorization in constructors
+
+If a contract's constructor calls `require_auth()` (or `require_auth_for_args()`), both `env.register(...)` and `env.register_at(...)` switch the environment to recording-auth mode for the duration of the constructor invocation, inheriting the mode from the current auth manager. Once the constructor returns, the previous auth manager is restored. This means constructor auth checks succeed for contracts registered with either function, without requiring `mock_all_auths()` to be called first.
+
+To have auth in a constructor execute as it will in production the contract must be deployed in the test using the standard deployment functions after being built to Wasm.
+
+:::caution
+
+This behaviour was not consistent in some versions of the `soroban-sdk` due to an issue, but is consistent as of v27.0.2.
+
+:::