diff --git a/config/examples/raspi3-encrypted.config b/config/examples/raspi3-encrypted.config
index c42f0fcc..a7a2aa5d 100644
--- a/config/examples/raspi3-encrypted.config
+++ b/config/examples/raspi3-encrypted.config
@@ -1,3 +1,7 @@
+# NOTE: the raspi3 HAL no longer ships a hardcoded test encryption key.
+# Nothing in this target calls wolfBoot_set_encrypt_key(), so an image
+# built with this config will reject encrypted updates until a key is
+# provisioned. See "Testing with kernel encryption" in docs/Targets.md.
 ARCH?=AARCH64
 TARGET?=raspi3
 SIGN?=RSA4096
diff --git a/docs/Targets.md b/docs/Targets.md
index e8e8eaa8..42a560af 100644
--- a/docs/Targets.md
+++ b/docs/Targets.md
@@ -3758,6 +3758,20 @@ make wolfboot.bin CROSS_COMPILE=aarch64-linux-gnu-
 printf "0123456789abcdef0123456789abcdef0123456789ab" > /tmp/enc_key.der
 ```
 
+* Provision the same key into the bootloader
+
+  The raspi3 HAL does not ship a hardcoded key: `hal_init()` used to call
+  `wolfBoot_set_encrypt_key()` with a fixed test key compiled into the
+  image, which meant every build shared one publicly known secret. It was
+  removed, so the bootloader now has no key until one is provisioned and
+  encrypted updates fail closed.
+
+  To run this demo, call `wolfBoot_set_encrypt_key()` with the 32-byte key
+  and 12-byte nonce from the file above at the end of `hal_init()` in
+  `hal/raspi3.c`. That is a development-only shortcut: a real deployment
+  must provision a per-device key from a source that is not in the
+  firmware image (see [encrypted_partitions.md](encrypted_partitions.md)).
+
 * Sign and encrypt Linux kernel image
 ```
 make keytools