diff --git a/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx b/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx
index 219901d4eb3..0cf9b848ed9 100644
--- a/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication.mdx
@@ -12,6 +12,12 @@ sidebar:
 
 import { AvailableNotifications, Render, Example } from "~/components";
 
+:::note[Availability]
+Access mTLS is available with Zero Trust contract plans. It is not included in Free, Pro, Business, or pay-as-you-go Zero Trust plans. Customers on these plans can use [service tokens](/cloudflare-one/access-controls/service-credentials/service-tokens/) to authenticate automated systems.
+
+This page covers Access mTLS for Service Auth policies. [Zone-level mTLS](/api-shield/security/mtls/) is a separate feature with different plan availability.
+:::
+
 [Mutual TLS (mTLS) authentication](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) requires both the client and the server to present certificates during the TLS handshake. In the Cloudflare Access implementation, the CA you upload is used to verify the client certificate (server certificate verification is handled by standard TLS). Access mTLS serves two purposes:
 
 - **Authenticate devices that do not use an identity provider** — Automated systems and IoT devices can prove their identity by presenting a client certificate instead of logging in through an IdP.