diff --git a/README.md b/README.md
index 8c17d2c..6dd7494 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,10 @@ The ``startup.sh`` script allows some customization on startup:
   * ``CORS_ALLOW_CREDENTIALS`` (default ``false``) **Setting this to ``true`` will only have the desired effect if ``CORS_ALLOWED_ORIGINS`` defines explicit origins (not ``*``)**
 * ``PROXY_BASE_URL`` to the base URL of the GeoServer web app if GeoServer is behind a proxy. Example: ``https://example.com/geoserver``.
 
+The CORS variables customize tomcat's `web.xml` file. If you need more customization, 
+you can provide your own customized `web.xml` file to tomcat by mounting it into the container 
+at `/opt/config_overrides/server.xml`.
+
 Example installing wps and ysld extensions:
 
 ```shell