diff --git a/config/300-clusterimagepolicy.yaml b/config/300-clusterimagepolicy.yaml
index 941bd47c4..686fa3ad1 100644
--- a/config/300-clusterimagepolicy.yaml
+++ b/config/300-clusterimagepolicy.yaml
@@ -113,14 +113,14 @@ spec:
                               description: PredicateType defines which predicate type to verify. Matches cosign verify-attestation options.
                               type: string
                       ctlog:
-                        description: CTLog sets the configuration to verify the authority against a Rekor instance.
+                        description: CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
                         type: object
                         properties:
                           trustRootRef:
                             description: Use the Public Key from the referred TrustRoot.TLog
                             type: string
                           url:
-                            description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
+                            description: URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
                             type: string
                       key:
                         description: Key defines the type of key to validate the image.
@@ -452,14 +452,14 @@ spec:
                               description: PredicateType defines which predicate type to verify. Matches cosign verify-attestation options.
                               type: string
                       ctlog:
-                        description: CTLog sets the configuration to verify the authority against a Rekor instance.
+                        description: CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
                         type: object
                         properties:
                           trustRootRef:
                             description: Use the Public Key from the referred TrustRoot.TLog
                             type: string
                           url:
-                            description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
+                            description: URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
                             type: string
                       key:
                         description: Key defines the type of key to validate the image.
diff --git a/docs/api-types/index-v1alpha1.md b/docs/api-types/index-v1alpha1.md
index 0dbc3d4c1..4afcb356b 100644
--- a/docs/api-types/index-v1alpha1.md
+++ b/docs/api-types/index-v1alpha1.md
@@ -169,7 +169,7 @@ Attestation defines the type of attestation to validate and optionally apply a p
 | keyless | Keyless sets the configuration to verify the authority against a Fulcio instance. | [KeylessRef](#keylessref) | false |
 | static | Static specifies that signatures / attestations are not validated but instead a static policy is applied against matching images. | [StaticRef](#staticref) | false |
 | source | Sources sets the configuration to specify the sources from where to consume the signature and attestations. | [][Source](#source) | false |
-| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
+| ctlog | CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled. | [TLog](#tlog) | false |
 | attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
 | rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
 | signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"legacy\" and \"bundle\". If not specified, the default is \"legacy\" (cosign's default). | string | false |
@@ -357,7 +357,7 @@ TLog specifies the URL to a transparency log that holds the signature and public
 
 | Field | Description | Scheme | Required |
 | ----- | ----------- | ------ | -------- |
-| url | URL sets the url to the rekor instance (by default the public rekor.sigstore.dev) | apis.URL | false |
+| url | URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled. | apis.URL | false |
 | trustRootRef | Use the Public Key from the referred TrustRoot.TLog | string | false |
 
 [Back to TOC](#table-of-contents)
diff --git a/docs/api-types/index.md b/docs/api-types/index.md
index 56c93cdf0..4804e466c 100644
--- a/docs/api-types/index.md
+++ b/docs/api-types/index.md
@@ -46,7 +46,7 @@ The authorities block defines the rules for discovering and validating signature
 | keyless | Keyless sets the configuration to verify the authority against a Fulcio instance. | [KeylessRef](#keylessref) | false |
 | static | Static specifies that signatures / attestations are not validated but instead a static policy is applied against matching images. | [StaticRef](#staticref) | false |
 | source | Sources sets the configuration to specify the sources from where to consume the signatures. | [][Source](#source) | false |
-| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
+| ctlog | CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled. | [TLog](#tlog) | false |
 | attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
 | rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
 | signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"legacy\" and \"bundle\". If not specified, the default is \"legacy\" (cosign's default). | string | false |
@@ -234,7 +234,7 @@ TLog specifies the URL to a transparency log that holds the signature and public
 
 | Field | Description | Scheme | Required |
 | ----- | ----------- | ------ | -------- |
-| url | URL sets the url to the rekor instance (by default the public rekor.sigstore.dev) | apis.URL | false |
+| url | URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled. | apis.URL | false |
 | trustRootRef | Use the Public Key from the referred TrustRoot.TLog | string | false |
 
 [Back to TOC](#table-of-contents)
diff --git a/pkg/apis/policy/v1alpha1/clusterimagepolicy_types.go b/pkg/apis/policy/v1alpha1/clusterimagepolicy_types.go
index 75a991593..7942eeacc 100644
--- a/pkg/apis/policy/v1alpha1/clusterimagepolicy_types.go
+++ b/pkg/apis/policy/v1alpha1/clusterimagepolicy_types.go
@@ -134,7 +134,7 @@ type Authority struct {
 	// Sources sets the configuration to specify the sources from where to consume the signature and attestations.
 	// +optional
 	Sources []Source `json:"source,omitempty"`
-	// CTLog sets the configuration to verify the authority against a Rekor instance.
+	// CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
 	// +optional
 	CTLog *TLog `json:"ctlog,omitempty"`
 	// Attestations is a list of individual attestations for this authority,
@@ -200,7 +200,7 @@ type Source struct {
 // TLog specifies the URL to a transparency log that holds
 // the signature and public key information
 type TLog struct {
-	// URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
+	// URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
 	// +optional
 	URL *apis.URL `json:"url,omitempty"`
 	// Use the Public Key from the referred TrustRoot.TLog
diff --git a/pkg/apis/policy/v1beta1/clusterimagepolicy_types.go b/pkg/apis/policy/v1beta1/clusterimagepolicy_types.go
index 44c3adf16..5f3ab922b 100644
--- a/pkg/apis/policy/v1beta1/clusterimagepolicy_types.go
+++ b/pkg/apis/policy/v1beta1/clusterimagepolicy_types.go
@@ -133,7 +133,7 @@ type Authority struct {
 	// Sources sets the configuration to specify the sources from where to consume the signatures.
 	// +optional
 	Sources []Source `json:"source,omitempty"`
-	// CTLog sets the configuration to verify the authority against a Rekor instance.
+	// CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
 	// +optional
 	CTLog *TLog `json:"ctlog,omitempty"`
 	// Attestations is a list of individual attestations for this authority,
@@ -197,7 +197,7 @@ type Source struct {
 // TLog specifies the URL to a transparency log that holds
 // the signature and public key information
 type TLog struct {
-	// URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
+	// URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
 	// +optional
 	URL *apis.URL `json:"url,omitempty"`
 	// Use the Public Key from the referred TrustRoot.TLog