diff --git a/modules/manage/pages/disaster-recovery/shadowing/setup.adoc b/modules/manage/pages/disaster-recovery/shadowing/setup.adoc
index db1f2ba3f..9b77fa673 100644
--- a/modules/manage/pages/disaster-recovery/shadowing/setup.adoc
+++ b/modules/manage/pages/disaster-recovery/shadowing/setup.adoc
@@ -93,7 +93,7 @@ This service account authenticates from the shadow cluster to the source cluster
 You must configure network connectivity between clusters with appropriate firewall rules to allow the shadow cluster to connect to the source cluster for data replication. Shadowing uses a pull-based architecture where the shadow cluster fetches data from the source cluster. For detailed networking configuration, see <<networking>>.
 
 ifndef::env-cloud[]
-If using xref:manage:security/authentication.adoc[authentication] for the shadow link connection, configure the source cluster with your chosen authentication method (SASL/SCRAM, TLS, mTLS) and ensure the shadow cluster has the proper credentials to authenticate to the source cluster.
+If using xref:manage:security/authentication.adoc[authentication] for the shadow link connection, configure the source cluster with your chosen authentication method (SASL/SCRAM, SASL/PLAIN, TLS, mTLS) and ensure the shadow cluster has the proper credentials to authenticate to the source cluster.
 endif::[]
 
 ifdef::env-cloud[]
@@ -156,10 +156,17 @@ client_options:
     do_not_set_sni_hostname: false   # Optional: Skip SNI hostname when using TLS (default: false)
   
   authentication_configuration:
+    # SASL/SCRAM authentication
     scram_configuration:
       username: <sasl-username>       # SASL/SCRAM username, example: "shadow-replication-user"
       password: <sasl-password>       # SASL/SCRAM password, example: "secure-password-123"
       scram_mechanism: SCRAM_SHA_256  # SCRAM mechanism: "SCRAM_SHA_256" or "SCRAM_SHA_512"
+ifndef::env-cloud[]
+    # SASL/PLAIN authentication
+    plain_configuration:
+      username: <sasl-username>       # SASL/PLAIN username, example: "shadow-replication-user"
+      password: <sasl-password>       # SASL/PLAIN password, example: "secure-password-123"
+endif::[]
   
   # Connection tuning - adjust based on network characteristics
   metadata_max_age_ms: 10000          # How often to refresh cluster metadata (default: 10000ms)
@@ -476,10 +483,17 @@ client_options:
 ----
 client_options:
   authentication_configuration:
+    # SASL/SCRAM authentication
     scram_configuration:
       username: <sasl-username>       # SASL/SCRAM username, example: "shadow-replication-user"
       password: <sasl-password>       # SASL/SCRAM password, example: "secure-password-123"
       scram_mechanism: SCRAM_SHA_256  # SCRAM mechanism: "SCRAM_SHA_256" or "SCRAM_SHA_512"
+ifndef::env-cloud[]
+    # SASL/PLAIN authentication
+    plain_configuration:
+      username: <sasl-username>       # SASL/PLAIN username, example: "shadow-replication-user"
+      password: <sasl-password>       # SASL/PLAIN password, example: "secure-password-123"
+endif::[]
 ----
 
 ==== Connection tuning