diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp
index 7656a676d647..f14f04de57fc 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.qhelp
@@ -58,6 +58,11 @@
       for example if parts of the session are memoized. Calling
       <code>protect_from_forgery with: :exception</code> can help to avoid this
       by raising an exception on an invalid CSRF token instead.
+      Note this remains true even in Rails version 5 and later: these versions
+      automatically run <code>protect_from_forgery with: :exception</code>
+      by default, but manually calling <code>protect_from_forgery</code> with
+      no <code>with</code> argument will still downgrade protection to provide an
+      empty session rather than raise an exception.
     </p>
 
   </example>
diff --git a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
index 9b8944b1d65c..5cbbbd1eea16 100644
--- a/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
+++ b/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.qhelp
@@ -42,6 +42,12 @@
       vulnerability - for example if parts of the session are memoized. Calling
       <code>protect_from_forgery with: :exception</code> can help to avoid this
       by raising an exception on an invalid CSRF token instead.
+
+      Note that Rails versions 5 and later
+      automatically run <code>protect_from_forgery with: :exception</code>
+      by default, but manually calling <code>protect_from_forgery</code> with
+      no <code>with</code> argument will downgrade protection to provide an empty
+      session rather than raise an exception.
     </p>
   </recommendation>