diff --git a/docs/cloud/guides/backups/03_bring_your_own_backup/03_backup_restore_using_commands.md b/docs/cloud/guides/backups/03_bring_your_own_backup/03_backup_restore_using_commands.md
index 5873b911d3c..0f9cde2a162 100644
--- a/docs/cloud/guides/backups/03_bring_your_own_backup/03_backup_restore_using_commands.md
+++ b/docs/cloud/guides/backups/03_bring_your_own_backup/03_backup_restore_using_commands.md
@@ -178,13 +178,27 @@ where `uuid` is a unique identifier, used to identify the backup.
 <TabItem value="Restore" label="RESTORE" default>
 
 ```sql
-RESTORE ALL EXCEPT TABLES system.users, system.roles
+RESTORE ALL
 FROM S3(
     'https://testchbackups.s3.amazonaws.com/<uuid>',
     '<key id>',
     '<key secret>'
 )
+SETTINGS restore_access_entities_with_current_grants = 1
 ```
+
+The `restore_access_entities_with_current_grants` setting is available from ClickHouse Cloud version **26.4** (build **26.4.1.1942** or later).
+You can check the version your service is running with:
+
+```sql
+SELECT version()
+```
+
+When `restore_access_entities_with_current_grants` is enabled, restored users and roles have their grants limited to what the restoring user is allowed to grant
+(the same semantics as [`GRANT CURRENT GRANTS`](/sql-reference/statements/grant)), instead of the `RESTORE`
+failing with `ACCESS_DENIED` when the backup contains more permissions than the restoring user can grant.
+
+On versions earlier than 26.4, omit the setting.
 </TabItem>
 </Tabs>