diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index ee013cda28bab..e5cedb8881d5a 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -396,6 +396,11 @@ including the messages sent by producers on that path, and keep applying while t
 only has producers applies their settings. A connection that was opened before these settings applied does not
 receive the messages of the producers, and it is closed when it sends a message.
 
+A connection opened while only producers served a path did not pass the custom `handlers` of a consumer, as those
+handlers run only for consumers. When a consumer that configures `handlers` is started on that path, such a connection
+is therefore no longer served: its messages do not reach the route, it does not receive what the producers send, and
+it is closed. Clients that open a connection before the consumer has started must reconnect after it has started.
+
 A WebSocket client that connected without satisfying the configured security provider or allowed roles is now
 rejected: it must authenticate, or the option must be removed from the WebSocket endpoint.
 
diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 934621f1cf422..5fb06ba6af28b 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -299,6 +299,19 @@ has an entry with a wildcard such as `https://*` or an entry `null`, the origin
 credentials. Previously credentials were allowed for every origin. A cross-origin client that sends cookies or other
 credentials must have its origin listed in `allowedOrigins`.
 
+=== camel-undertow - a WebSocket connection opened before a consumer with custom handlers started is no longer served
+
+On a WebSocket path whose producer applies a security provider or allowed roles, a connection could be accepted while
+only the producer served the path, before its consumer was started for the first time. Such a connection ran the
+producer checks but not the custom `handlers` the consumer configures, as those handlers run only for consumers. Once
+the consumer was started, the connection was still treated as having passed the consumer checks, so its messages
+reached the route and it kept receiving what the producer sent.
+
+Once a consumer that configures `handlers` is started on a path, a connection opened on that path before the consumer
+first ran is no longer served: its messages no longer reach the route and it no longer receives what the producer
+sends, and the connection is closed. Clients that open a connection in this window must reconnect after the consumer
+has started.
+
 == Upgrading from 4.22.1 to 4.22.2
 
 === camel-lra - only an LRA hosted by the configured coordinator is joined