diff --git a/docs/usage/nuget.md b/docs/usage/nuget.md
index 151da12225bb9671538beb63e9b3306850c73a16..67c8409dcd4b620c9b9ef369b78de88646192f7b 100644
--- a/docs/usage/nuget.md
+++ b/docs/usage/nuget.md
@@ -118,13 +118,17 @@ Credentials for authenticated/private feeds can be given via host rules in the c
 }
 ```
 
-If you're using Azure DevOps, you can set `matchHost` to `pkgs.dev.azure.com`.
+If you use Azure DevOps:
+
+- set `matchHost` to `pkgs.dev.azure.com`
+- set the username, so Renovate can build the project when it creates the PR
 
 <!-- prettier-ignore -->
 !!! note
     Only Basic HTTP authentication (via username and password) is supported.
-    For Azure DevOps, you can use a PAT with `read` permissions on `Packaging` plus an empty username.
-    The generated `nuget.config` enforces basic authentication and cannot be overridden externally!
+    For Azure DevOps: use a PAT with `read` permissions on `Packaging`.
+    The username of the PAT must match the username of the _user of the PAT_.
+    The generated `nuget.config` forces the basic authentication, which cannot be overridden externally!
 
 ## Future work