diff --git a/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md b/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md
index 05f9b8369c..da59b907c4 100644
--- a/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md
+++ b/content/en/docs/reference/access-authn-authz/extensible-admission-controllers.md
@@ -591,7 +591,7 @@ is not considered to match.
 Use the object selector only if the webhook is opt-in, because end users may skip
 the admission webhook by setting the labels.
 
-This example shows a mutating webhook that would match a `CREATE` of any resource with the label `foo: bar`:
+This example shows a mutating webhook that would match a `CREATE` of any resource (but not subresources) with the label `foo: bar`:
 
 ```yaml
 apiVersion: admissionregistration.k8s.io/v1