diff --git a/playbooks/roles/letsencrypt-acme-sh-install/README.rst b/playbooks/roles/letsencrypt-acme-sh-install/README.rst
index 76595607a0..2f55644bf4 100644
--- a/playbooks/roles/letsencrypt-acme-sh-install/README.rst
+++ b/playbooks/roles/letsencrypt-acme-sh-install/README.rst
@@ -7,3 +7,11 @@ Additionally a ``driver.sh`` script is installed to run the
 authentication procedure and parse output.
 
 **Role Variables**
+
+.. zuul:rolevar:: letsencrypt_gid
+   :default: unset
+
+   Unix group `gid` for the `letsencrypt` group which has permissions
+   on the `/etc/letsencrypt-certificates` directory.  If unset, uses
+   system default.  Useful if this conflicts with another role that
+   assumes a `gid` value.