diff --git a/modules/programs/ssmtp.nix b/modules/programs/ssmtp.nix
index d8a324190f6..f61d14c2046 100644
--- a/modules/programs/ssmtp.nix
+++ b/modules/programs/ssmtp.nix
@@ -75,7 +75,7 @@ let
         default = "";
         example = "correctHorseBatteryStaple";
         description = "
-          Password used for SMTP auth.
+          Password used for SMTP auth. (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
         ";
       };
 
diff --git a/modules/services/databases/redis.nix b/modules/services/databases/redis.nix
index 9472136e17e..5bc58c73bd6 100644
--- a/modules/services/databases/redis.nix
+++ b/modules/services/databases/redis.nix
@@ -122,12 +122,13 @@ in
         default = null;
         description = ''If the master is password protected (using the requirePass configuration)
         it is possible to tell the slave to authenticate before starting the replication synchronization
-        process, otherwise the master will refuse the slave request.'';
+        process, otherwise the master will refuse the slave request.
+        (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
       };
 
       requirePass = mkOption {
         default = null;
-        description = "Password for database";
+        description = "Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)";
         example = "letmein!";
       };