diff --git a/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 b/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2
index 760fd574..900369b9 100644
--- a/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2
+++ b/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2
@@ -36,6 +36,9 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} run --rm --n
 # The `CAP_DAC_OVERRIDE` capability is required, so that `root` in the container
 # can read the `/etc/borgmatic.d/config.yaml` (`{{ matrix_backup_borg_config_path }}/config.yaml`) file,
 # owned by `matrix:matrix` on the filesystem.
+#
+# `/root` is mountes as temporary filesystem, because we're using `--read-only` and because
+# Borgmatic tries to write to at least a few paths under `/root` (`.config`, `.ssh`, `.borgmatic`).
 ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-backup-borg \
 			--log-driver=none \
 			--cap-drop=ALL \