diff --git a/pkg/templates/managed-serviceaccount/crds/authentication.open-cluster-management.io_managedserviceaccounts.yaml b/pkg/templates/managed-serviceaccount/crds/authentication.open-cluster-management.io_managedserviceaccounts.yaml
index 8194a90ee..57ccb9284 100644
--- a/pkg/templates/managed-serviceaccount/crds/authentication.open-cluster-management.io_managedserviceaccounts.yaml
+++ b/pkg/templates/managed-serviceaccount/crds/authentication.open-cluster-management.io_managedserviceaccounts.yaml
@@ -210,13 +210,13 @@ spec:
                   enabled:
                     default: true
                     description: |-
-                      Enabled prescribes whether the ServiceAccount token will
-                      be rotated from the upstream
+                      Enabled prescribes whether the ServiceAccount token will be rotated before it expires.
+                      Deprecated: All ServiceAccount tokens will be rotated before they expire regardless of this field.
                     type: boolean
                   validity:
                     default: 8640h0m0s
-                    description: Validity is the duration for which the signed ServiceAccount
-                      token is valid.
+                    description: Validity is the duration of validity for requesting
+                      the signed ServiceAccount token.
                     type: string
                 type: object
               ttlSecondsAfterCreation: