diff --git a/internal/cli/users.go b/internal/cli/users.go
index 4f51923..ea05b97 100644
--- a/internal/cli/users.go
+++ b/internal/cli/users.go
@@ -171,7 +171,10 @@ func newUserStateCmd(open userOpener, verb string, state store.UserState, short
 				if err := s.DeleteUserSessions(cmd.Context(), u.ID); err != nil {
 					return err
 				}
-				cmd.PrintErrln("Their sessions were closed. Their API keys still work — revoke those separately.")
+				// The keys are refused by their owner's state, which every
+				// router reads again within auth.cache_ttl.
+				cmd.PrintErrln("Their sessions were closed. Their API keys are refused within auth.cache_ttl " +
+					"(30 s by default), and work again if they are reinstated.")
 			}
 			fmt.Fprintf(cmd.OutOrStdout(), "%s is now %s\n", u.Email, state)
 			return nil