diff --git a/frontend/src/lib/components/InstanceSettings.svelte b/frontend/src/lib/components/InstanceSettings.svelte
index bbe5432f06..0a21e8897e 100644
--- a/frontend/src/lib/components/InstanceSettings.svelte
+++ b/frontend/src/lib/components/InstanceSettings.svelte
@@ -1144,10 +1144,11 @@
 				description="Configure where secrets (secret variables) are stored."
 				link="https://www.windmill.dev/docs/core_concepts/workspace_secret_encryption"
 			/>
-		{:else if category == 'GitHub Enterprise App'}
+		{:else if category == 'GitHub App'}
 			<SettingsPageHeader
-				title="GitHub Enterprise App"
-				description="Configure a self-managed GitHub App for GitHub Enterprise Server git sync."
+				title="GitHub App"
+				description="Configure a self-managed GitHub App for git sync on GitHub.com, GHE Cloud or GitHub Enterprise Server."
+				link="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
 			/>
 		{:else if category == 'DB Health'}
 			<SettingsPageHeader
diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 0daca6b225..70121a1181 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -1005,9 +1005,11 @@ export const settings: Record<string, Setting[]> = {
 	],
 	'GitHub App': [
 		{
-			label: 'GitHub App',
+			// The category header above already names the section; this labels the
+			// card that holds the app credentials, next to the webhook base url one.
+			label: 'App configuration',
 			description:
-				'Configure a self-managed GitHub App to enable git sync without stats.windmill.dev.',
+				'Use your own GitHub App instead of the Windmill-managed one on stats.windmill.dev.',
 			key: 'github_enterprise_app',
 			fieldType: 'github_enterprise_app',
 			storage: 'setting',
diff --git a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
index ae5347d278..da63e8d64a 100644
--- a/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
+++ b/frontend/src/lib/components/instanceSettings/GhesAppSettings.svelte
@@ -194,13 +194,34 @@
 					<li>
 						<strong>Callback URL</strong>: <code>&lt;your-windmill-url&gt;/gh_success</code>
 					</li>
-					<li>Uncheck <strong>Active</strong> under Webhook (not needed)</li>
+					<li>
+						Uncheck <strong>Active</strong> under Webhook. Windmill registers the webhooks it
+						needs per repository, so the app-level webhook stays unused.
+					</li>
 				</ul>
 				<p><strong>3.</strong> Set repository permissions:</p>
 				<ul class="list-disc ml-4 space-y-1">
 					<li><strong>Contents</strong>: Read &amp; write</li>
 					<li><strong>Metadata</strong>: Read-only</li>
 				</ul>
+				<p>
+					Those two are the minimum, for the push direction (Windmill &rarr; git). Add these for
+					the pull direction (git &rarr; Windmill), all read &amp; write:
+				</p>
+				<ul class="list-disc ml-4 space-y-1">
+					<li>
+						<strong>Repository webhooks</strong>: deploy commits within seconds instead of
+						polling the repository
+					</li>
+					<li>
+						<strong>Pull requests</strong>: open pull requests for the branches Windmill pushes,
+						and maintain the deploy-preview comment
+					</li>
+					<li>
+						<strong>Checks</strong>: post the "Windmill diff" and deploy status checks on commits
+						and pull requests
+					</li>
+				</ul>
 				<p>
 					<strong>4.</strong> Under "Where can this GitHub App be installed?", choose
 					<strong>Any account</strong> (or restrict to your organization).
@@ -219,7 +240,18 @@
 				</p>
 				<p>
 					<strong>8.</strong> The <strong>Base URL</strong> is your GitHub instance root (e.g.
-					<code>https://github.com</code> or <code>https://github.mycompany.com</code>).
+					<code>https://github.com</code>, <code>https://mycompany.ghe.com</code> or
+					<code>https://github.mycompany.com</code>). On GHE Cloud (<code>*.ghe.com</code>), also
+					set <strong>App owner</strong> to the organization or user that owns the app: its
+					installation urls carry the owner.
+				</p>
+				<p>
+					Full setup guide: <a
+						href="https://www.windmill.dev/docs/integrations/git_repository#self-managed-github-app"
+						target="_blank"
+						rel="noreferrer"
+						class="underline">Self-managed GitHub App</a
+					>.
 				</p>
 			</div>
 		</details>