diff --git a/content/configuration/security-limits.md b/content/configuration/security-limits.md
index c4320a5b..44f51df5 100644
--- a/content/configuration/security-limits.md
+++ b/content/configuration/security-limits.md
@@ -176,6 +176,7 @@ Allows you to configure hard technical limits, to prevent abuse and optimize for
 | `USERS_APP_ACCESS_LIMIT`      | How many active users with access to the Data Studio are allowed.                                                                  | `Infinity`    |
 | `USERS_API_ACCESS_LIMIT`      | How many active API access users are allowed.                                                                                      | `Infinity`    |
 | `GRAPHQL_QUERY_TOKEN_LIMIT`   | How many GraphQL query tokens will be parsed.                                                                                      | 5000          |
+| `GRAPHQL_SINGLE_USE_MUTATIONS` | Sensitive system mutations that are limited to one use per GraphQL request.                                                        | See <sup>[1]</sup> |
 | `MAX_PAYLOAD_SIZE`            | Controls the maximum request body size. Accepts number of bytes, or human readable string.                                         | `1mb`         |
 | `MAX_BATCH_MUTATION`          | The maximum number of items for batch mutations when creating, updating and deleting.                                              | `Infinity`    |
 | `MAX_RELATIONAL_DEPTH`        | The maximum depth when filtering / querying relational fields, with a minimum value of `2`.                                        | `10`          |
@@ -185,3 +186,5 @@ Allows you to configure hard technical limits, to prevent abuse and optimize for
 | `QUERYSTRING_MAX_PARSE_DEPTH` | The maximum object depth when parsing URL query parameters using the querystring format                                            | `10`          |
 | `QUERYSTRING_ARRAY_LIMIT`     | The array limit when parsing URL query parameters using the querystring format                                                     | `500`         |
 | `MAX_IMPORT_ERRORS`           | The maximum number of validation errors permitted while importing records before the process is cancelled and the errors returned. | `1000`        |
+
+<sup>[1]</sup> Defaults to `auth_login`, `auth_refresh`, `auth_password_request`, `auth_password_reset`, `users_register`, `users_register_verify`, `users_invite_accept`, `users_me_tfa_generate`, `users_me_tfa_enable`, `users_me_tfa_disable`, and `utils_cache_clear`. Setting your own list overrides these.