diff --git a/docs/koji/safeclient.md b/docs/koji/safeclient.md
new file mode 100644
index 0000000000000000000000000000000000000000..fcf5099c926db035dffb3bb21aa18bb971868461
--- /dev/null
+++ b/docs/koji/safeclient.md
@@ -0,0 +1,23 @@
+# Avoid using production as default
+
+For koji admins who are frequently running commands such as `koji add-tag` on test koji instances it can be dangerous to have the client use the default koji service in `/etc/koji.conf` as the production service.
+
+To override the default configuration file create a file `~/.config/koji/prod.conf` containing:
+
+```ini
+[koji]
+server = https://useprodprofile.cern.ch/kojihub
+weburl = https://useprodprofile.cern.ch
+topurl = https://useprodprofile.cern.ch/kojifiles
+topdir = https://useprodprofile.cern.ch/kojifiles
+authtype = kerberos
+
+[prod]
+server = https://kojihub.cern.ch/kojihub
+weburl = https://koji.cern.ch
+topurl = https://koji.cern.ch/kojifiles
+topdir = https://koji.cern.ch/kojifiles
+authtype = kerberos
+```
+
+Once done the production profile must be explicitly specified with `koji -p prod`. All koji commands will fail unless a profile is specified.
diff --git a/mkdocs.yml b/mkdocs.yml
index 71aa6bf3b15a7c4e00019a83da3e7d4f7f5e5d1b..7d59def95f9595e936562368c18a6b4ee923908d 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -57,6 +57,7 @@ nav:
     - 'Red Hat support': support/redhat.md
     - 'Koji':
         - 'Introduction': koji/introduction.md
+        - 'Safe admin client config': koji/safeclient.md
         - 'Building RPMs': koji/building.md
         - 'Adding users to koji': koji/addingusers.md
         - 'Untagging policy': koji/untagging.md