diff --git a/datacenter/dtr/2.3/guides/admin/upgrade.md b/datacenter/dtr/2.3/guides/admin/upgrade.md
index a757f77d71..ac945bcc2f 100644
--- a/datacenter/dtr/2.3/guides/admin/upgrade.md
+++ b/datacenter/dtr/2.3/guides/admin/upgrade.md
@@ -37,13 +37,11 @@ to ensure the impact on your business is close to none.
 
 ## Minor upgrade
 
-Before starting your upgrade planning, make sure that the version of UCP you are
-using is supported by the version of DTR you are trying to upgrade to.
-
-> Backup DTR before upgrading
->
-> Before performing any upgrade it’s important to backup. See
-> [DTR backups and recovery](backups-and-disaster-recovery.md).
+Before starting your upgrade, make sure that:
+* The version of UCP you are using is supported by the version of DTR you
+are trying to upgrade to.
+* You have a recent [DTR backup](backups-and-disaster-recovery.md).
+* You [disable Docker content trust in UCP](/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md).
 
 ### Step 1. Upgrade DTR to 2.2 if necessary
 
diff --git a/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md b/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
index 4d9843b5e7..14c893c7b0 100644
--- a/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
+++ b/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
@@ -50,7 +50,9 @@ dropdown and select those teams from the list.
 If you specify multiple teams, the image needs to be signed by a member of each
 team, or someone that is a member of all those teams.
 
-Click **Save** for UCP to start enforcing the policy.
+Click **Save** for UCP to start enforcing the policy. From now on, existing
+services will continue running and can be restarted if needed, but UCP will only
+allow deploying new services that use a trusted image.
 
 ## Where to go next