diff --git a/deploy/charts/buzz/README.md b/deploy/charts/buzz/README.md
index 288681b0c9..4e72ee5deb 100644
--- a/deploy/charts/buzz/README.md
+++ b/deploy/charts/buzz/README.md
@@ -125,8 +125,10 @@ checkpoints remain the execution authority.
 
 The pod receives only `DATABASE_URL`, `REDIS_URL`, and required S3
 configuration/credential variables. It does not receive the relay private key,
-git-hook secret, relay URL, service-account token, service links, or a generic
-environment registry. Schedule,
+git-hook secret, relay URL, service links, or a generic environment registry.
+The chart disables the ordinary Kubernetes API service-account token mount;
+platform workload-identity admission may still inject its own projected token
+and provider environment variables. Schedule,
 deadline, history, termination grace, resources, service account, pod labels,
 and pod annotations are independently configurable under
 `operatorJobs.deletionDrain`.
diff --git a/docs/operator-community-deletion.md b/docs/operator-community-deletion.md
index 546f73cf3d..61d8fd8945 100644
--- a/docs/operator-community-deletion.md
+++ b/docs/operator-community-deletion.md
@@ -49,17 +49,19 @@ non-secret S3 settings. It does not receive `BUZZ_RELAY_PRIVATE_KEY`,
 `BUZZ_GIT_HOOK_HMAC_SECRET`, `RELAY_URL`, or the full Secret through `envFrom`.
 The pod also disables service-account token automounting and Kubernetes service
 link environment injection because the executor does not call the Kubernetes
-API or discover cluster Services.
+API or discover cluster Services. This disables the ordinary Kubernetes API
+token mount, not credentials injected by a platform workload-identity
+mechanism.
 
 Leaving `operatorJobs.deletionDrain.serviceAccountName` empty falls back to the
-relay's own service account. `automountServiceAccountToken: false` only
-suppresses the projected token inside the pod; it does not detach the identity.
-Cloud IAM bindings attached to that service account — IRSA on EKS, Workload
-Identity on GKE — are resolved by the node/metadata path and still apply, so the
-drain pod inherits the relay's cloud permissions. Create a dedicated service
-account with only the object-store permissions listed below and name it
-explicitly if you want the executor's IAM blast radius to be smaller than the
-relay's.
+relay's own service account, including cloud IAM attached through the platform's
+workload-identity mechanism. For example, the EKS IRSA admission webhook can
+inject its projected web-identity token and AWS environment variables despite
+`automountServiceAccountToken: false`; other platforms provide their own
+identity mechanism. The drain pod therefore inherits the relay's cloud role by
+default. Create a dedicated service account with only the object-store
+permissions listed below and name it explicitly if you want the executor's IAM
+blast radius to be smaller than the relay's.
 
 The S3 principal needs the relay's normal object permissions plus bucket-level
 `s3:ListBucketVersions` and object-level `s3:DeleteObjectVersion` for every