diff --git a/docs/getting-started/sec-app-requirements.asciidoc b/docs/getting-started/sec-app-requirements.asciidoc
index e5034066a8..afe2f504a3 100644
--- a/docs/getting-started/sec-app-requirements.asciidoc
+++ b/docs/getting-started/sec-app-requirements.asciidoc
@@ -17,6 +17,13 @@ https://www.elastic.co/cloud/elasticsearch-service[cloud deployment],
 available on Azure, AWS, and GCP. You can {ess-trial}[try it out for free].
 ==============
 
+[discrete]
+[[node-role-requirements]]
+== Node role requirements
+To use Elastic Security, at least one node in your Elasticsearch cluster must have the {ref}/transform-settings.html[`transform` role]. Nodes are automatically given this role when they’re created, so changes are not required if default role settings remain the same. This applies to on-premise and cloud deployments.
+
+Changes might be required if your nodes have customized roles. When updating node roles, nodes are only assigned the roles you specify, and default roles are removed. If you need to reassign the `transform` role to a node, {ref}/modules-node.html#transform-node[create a dedicated transform node].
+
 [discrete]
 == {kib} space and index privileges