diff --git a/Documentation/config.txt b/Documentation/config.txt
index 475e874d51550eba26a578c0ce3b17b61384fddc..2c1d7494b92134f8b9cc53f932ef381e882d6808 100644
--- a/Documentation/config.txt
+++ b/Documentation/config.txt
@@ -3208,6 +3208,13 @@ url..insteadOf::
the best alternative for the particular user, even for a
never-before-seen repository on the site. When more than one
insteadOf strings match a given URL, the longest match is used.
++
+Note that any protocol restrictions will be applied to the rewritten
+URL. If the rewrite changes the URL to use a custom protocol or remote
+helper, you may need to adjust the `protocol.*.allow` config to permit
+the request. In particular, protocols you expect to use for submodules
+must be set to `always` rather than the default of `user`. See the
+description of `protocol.allow` above.
url..pushInsteadOf::
Any URL that starts with this value will not be pushed to;
diff --git a/contrib/persistent-https/README b/contrib/persistent-https/README
index f784dd2e66b9373285027dc1c47948231b172f46..7c4cd8d257da0d64098f6b31834280e90f6e4f31 100644
--- a/contrib/persistent-https/README
+++ b/contrib/persistent-https/README
@@ -35,6 +35,16 @@ to use persistent-https:
[url "persistent-http"]
insteadof = http
+You may also want to allow the use of the persistent-https helper for
+submodule URLs (since any https URLs pointing to submodules will be
+rewritten, and Git's out-of-the-box defaults forbid submodules from
+using unknown remote helpers):
+
+[protocol "persistent-https"]
+ allow = always
+[protocol "persistent-http"]
+ allow = always
+
#####################################################################
# BUILDING FROM SOURCE