diff --git a/docs/RegistryAuthentication.md b/docs/RegistryAuthentication.md
index 2d95b157..26340019 100644
--- a/docs/RegistryAuthentication.md
+++ b/docs/RegistryAuthentication.md
@@ -29,16 +29,29 @@ The `credsStore` section is a single string property whose value is the name of
 
 In some scenarios the standard Docker authentication mechanism described above just doesn't cut it. This tooling has an additional mechanism for providing credentials to registries: environment variables. If environment variables are used, the credential provide mechanism will not be used at all. The following environment variables are supported:
 
+_Preferred_
+
+* DOTNET_CONTAINER_PUSH_REGISTRY_UNAME
+  * This should be the username for the _destination_ registry. If the password for the registry is a token, then the username should be `"<token>"`.
+* DOTNET_CONTAINER_PUSH_REGISTRY_PWORD
+  * This should be the password, token, etc for the _destination_ registry.
+
+* DOTNET_CONTAINER_PULL_REGISTRY_UNAME
+  * This should be the username for the _source_ registry. If the password for the registry is a token, then the username should be `"<token>"`.
+* DOTNET_CONTAINER_PULL_REGISTRY_PWORD
+  * This should be the password, token, etc for the _source_ registry.
+
+_Supported but not recommended_
 * DOTNET_CONTAINER_REGISTRY_UNAME
   * This should be the username for the registry. If the password for the registry is a token, then the username should be `"<token>"`.
 * DOTNET_CONTAINER_REGISTRY_PWORD
   * This should be the password, token, etc for the registry.
 
 > [!NOTE]
-> As of .NET SDK 8.0.400, the environment variables for container operations have been updated.  
-> `SDK_CONTAINER_*` variables are now prefixed with `DOTNET_CONTAINER_*`. Please use the old prefixes in your configuration files or scripts.
+> The not recommended environment variables aren't namespaced - the SDK will attempt to use the same credentials for both the 'source' registry (where your base image is located) as well as the 'destination' registry (where you are pushing your final image). This is why we prefer the usage of the separate PUSH and PULL variables.
 
-This mechanism is potentially vulnerable to credential leakage, so it should only be used in scenarios where the other mechanism is not available. For example, if you are using the SDK Container tooling inside a Docker container itself. In addition, this mechanism isn't namespaced - it will attempt to use the same credentials for both the 'source' registry (where your base image is located) as well as the 'destination' registry (where you are pushing your final image).
+> [!NOTE]
+> All environment-variable based usage is vulnerable to credential leakage as other processes or build logic may be able to access the environment variables of the SDK process. We recommend using the credential helper-based approaches listed above for this reason.
 
 ## Known-supported registries