diff --git a/scripts/argocd-admin-password b/scripts/argocd-admin-password
index 198fd0e4a6..d84aff5032 100755
--- a/scripts/argocd-admin-password
+++ b/scripts/argocd-admin-password
@@ -1,5 +1,5 @@
 #!/bin/sh
 
-# Get ArgoCD initial admin password
+echo "WARNING: ArgoCD admin can do anything in the cluster, only use it for just enough initial setup or in emergencies." >&2
 export KUBECONFIG=./metal/kubeconfig.yaml
 kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
diff --git a/scripts/vault-root-token b/scripts/vault-root-token
index 72730acf13..8e0a483179 100755
--- a/scripts/vault-root-token
+++ b/scripts/vault-root-token
@@ -1,5 +1,5 @@
 #!/bin/sh
 
-# Get Vault root token
+echo "WARNING: Root token can do anything in Vault, only use it for just enough initial setup or in emergencies." >&2
 export KUBECONFIG=./metal/kubeconfig.yaml
 kubectl get secrets vault-unseal-keys -n vault -o jsonpath='{.data.vault-root}' | base64 --decode