diff --git a/lib/modules/manager/gomod/readme.md b/lib/modules/manager/gomod/readme.md
index e17e507cc135e35232a78173d21d0d28893f9114..62d912c31d59ac157de1571727632ce2b2455b39 100644
--- a/lib/modules/manager/gomod/readme.md
+++ b/lib/modules/manager/gomod/readme.md
@@ -1,3 +1,5 @@
+### Post-Update Options
+
 You might be interested in the following `postUpdateOptions`:
 
 1. `gomodTidy` - if you'd like Renovate to run `go mod tidy` after every update before raising the PR
@@ -23,3 +25,20 @@ Indirect updates are disabled by default. To enable them, add a package rule suc
   ]
 }
 ```
+
+### Private Modules Authentication
+
+Before running the `go` commands to update the `go.sum`, Renovate exports `git` [`insteadOf`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) directives in environment variables.
+
+The following logic is executed prior to "artifacts" updating:
+
+The token from the `hostRules` entry matching `hostType=github` and `matchHost=api.github.com` is added as the default authentication for `github.com`.
+For those running against `github.com`, this token will be the default platform token.
+
+Next, all `hostRules` with both a token and `matchHost` will be fetched, except for any github.com one from above.
+
+Rules from this list are converted to environment variable directives if they match _any_ of the following characteristics:
+
+- No `hostType` is defined, or
+- `hostType` is `go`, or
+- `hostType` is a platform (`github`, `gitlab`, `azure`, etc.)