diff --git a/ee/app/views/groups/settings/_enforce_ssh_certificates.html.haml b/ee/app/views/groups/settings/_enforce_ssh_certificates.html.haml
index 74fb495b01e70aca009ab1b835b56207977ef2e2..78319dcce53534a80f57eb1f00e0e7e46edf678a 100644
--- a/ee/app/views/groups/settings/_enforce_ssh_certificates.html.haml
+++ b/ee/app/views/groups/settings/_enforce_ssh_certificates.html.haml
@@ -2,6 +2,9 @@
   %h5= s_('GroupSettings|Enforce SSH Certificates')
 
   .form-group.gl-mb-3
-    = f.gitlab_ui_checkbox_component :enforce_ssh_certificates,
-        s_('GroupSettings|Enforce SSH Certificates'),
-        checkbox_options: { disabled: !can?(current_user, :admin_group, group), checked: group.enforce_ssh_certificates? }
+    = f.gitlab_ui_checkbox_component :enforce_ssh_certificates, checkbox_options: { disabled: !can?(current_user, :admin_group, group), checked: group.enforce_ssh_certificates? } do |c|
+      - c.with_label do
+        = s_('GroupSettings|Enforce SSH Certificates')
+      - c.with_help_text do
+        = _("GroupSettings|If enabled, individual user accounts will be able to use only issued SSH certificates for Git access. It doesn't apply to service accounts, deploy keys, and other types of internal accounts.")
+        = link_to _('GroupSettings|How do I manage group SSH certificates?'), help_page_path('user/group/ssh_certificates')
diff --git a/ee/spec/views/groups/settings/_enforce_ssh_certificates.html.haml_spec.rb b/ee/spec/views/groups/settings/_enforce_ssh_certificates.html.haml_spec.rb
index 51884c94df32a08e025a3dd1d9962938ff182e85..285e4ddd4104a76fd91aa3fdf9c168c2c4953802 100644
--- a/ee/spec/views/groups/settings/_enforce_ssh_certificates.html.haml_spec.rb
+++ b/ee/spec/views/groups/settings/_enforce_ssh_certificates.html.haml_spec.rb
@@ -24,9 +24,7 @@
       allow(view).to receive(:f).and_return(form)
       allow(group).to receive(:ssh_certificates_available?).and_return(true)
 
-      expect(form).to receive(:gitlab_ui_checkbox_component).with(
-        :enforce_ssh_certificates, "Enforce SSH Certificates", anything
-      )
+      expect(form).to receive(:gitlab_ui_checkbox_component).with(:enforce_ssh_certificates, anything)
 
       render
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index e77a3f27359770e2c671744b1c875a3b53bfd398..67931797146d03eaa03bd749f87cff35148c221f 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -24079,6 +24079,12 @@ msgstr ""
 msgid "GroupSettings|Group path cannot be longer than %{length} characters."
 msgstr ""
 
+msgid "GroupSettings|How do I manage group SSH certificates?"
+msgstr ""
+
+msgid "GroupSettings|If enabled, individual user accounts will be able to use only issued SSH certificates for Git access. It doesn't apply to service accounts, deploy keys, and other types of internal accounts."
+msgstr ""
+
 msgid "GroupSettings|If not specified at the group or instance level, the default is %{default_initial_branch_name}. Does not affect existing repositories."
 msgstr ""