diff --git a/SECURITY.md b/SECURITY.md
index 5b4c75f485f..45d75542bb4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -232,9 +232,14 @@ import java.security.Security;
 ...
 
 // Somewhere in main()
-Security.insertProviderAt(Conscrypt.newProvider(), 1);
+Security.insertProviderAt(
+    Conscrypt.newProviderBuilder().provideTrustManager(false).build(), 1);
 ```
 
+Note: according to [Conscrypt Implementation Notes](https://github.com/google/conscrypt/blob/2.4.0/IMPLEMENTATION_NOTES.md#hostname-verification),
+its default `HostnameVerifier` on OpenJDK always fails. This can be worked 
+around by disabling its default `TrustManager` implementation as shown above.
+
 ### TLS with Jetty ALPN
 
 **Please do not use Jetty ALPN**