diff --git a/conf/insideout/sip_profiles/external.xml b/conf/insideout/sip_profiles/external.xml
index f021a4c3c6..22fd155434 100644
--- a/conf/insideout/sip_profiles/external.xml
+++ b/conf/insideout/sip_profiles/external.xml
@@ -48,7 +48,7 @@
     <param name="auth-calls" value="false"/>
     <param name="rtp-timeout-sec" value="1800"/>
     <param name="inbound-late-negotiation" value="true"/>
-    <param name="inbound-zrtp-passthru" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/> <!-- (also enables late negotiation) -->
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/insideout/sip_profiles/internal-ipv6.xml b/conf/insideout/sip_profiles/internal-ipv6.xml
index b9907a78ad..525554f4b8 100644
--- a/conf/insideout/sip_profiles/internal-ipv6.xml
+++ b/conf/insideout/sip_profiles/internal-ipv6.xml
@@ -69,7 +69,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/conf/insideout/sip_profiles/internal.xml b/conf/insideout/sip_profiles/internal.xml
index e406cd5e72..666f7de5ab 100644
--- a/conf/insideout/sip_profiles/internal.xml
+++ b/conf/insideout/sip_profiles/internal.xml
@@ -104,7 +104,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/conf/sbc/sbc_profiles/external.xml b/conf/sbc/sbc_profiles/external.xml
index 0f15159f58..7bf024658b 100644
--- a/conf/sbc/sbc_profiles/external.xml
+++ b/conf/sbc/sbc_profiles/external.xml
@@ -49,7 +49,7 @@
     <param name="auth-calls" value="false"/>
     <param name="rtp-timeout-sec" value="1800"/>
     <param name="inbound-late-negotiation" value="true"/>
-    <param name="inbound-zrtp-passthru" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/> <!-- (also enables late negotiation) -->
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/sbc/sbc_profiles/internal-ipv6.xml b/conf/sbc/sbc_profiles/internal-ipv6.xml
index b9907a78ad..525554f4b8 100644
--- a/conf/sbc/sbc_profiles/internal-ipv6.xml
+++ b/conf/sbc/sbc_profiles/internal-ipv6.xml
@@ -69,7 +69,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/conf/sbc/sbc_profiles/internal.xml b/conf/sbc/sbc_profiles/internal.xml
index 3081052c88..d4b2efd37b 100644
--- a/conf/sbc/sbc_profiles/internal.xml
+++ b/conf/sbc/sbc_profiles/internal.xml
@@ -110,7 +110,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/conf/vanilla/sip_profiles/external.xml b/conf/vanilla/sip_profiles/external.xml
index 4f18e84be7..5070c87913 100644
--- a/conf/vanilla/sip_profiles/external.xml
+++ b/conf/vanilla/sip_profiles/external.xml
@@ -57,7 +57,7 @@
     <param name="nonce-ttl" value="60"/>
     <param name="auth-calls" value="false"/>
     <param name="inbound-late-negotiation" value="true"/>
-    <param name="inbound-zrtp-passthru" value="true"/>
+    <param name="inbound-zrtp-passthru" value="true"/> <!-- (also enables late negotiation) -->
     <!--
         DO NOT USE HOSTNAMES, ONLY IP ADDRESSES IN THESE SETTINGS!
     -->
diff --git a/conf/vanilla/sip_profiles/internal-ipv6.xml b/conf/vanilla/sip_profiles/internal-ipv6.xml
index 18274faa4f..62b9708e8b 100644
--- a/conf/vanilla/sip_profiles/internal-ipv6.xml
+++ b/conf/vanilla/sip_profiles/internal-ipv6.xml
@@ -70,7 +70,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/conf/vanilla/sip_profiles/internal.xml b/conf/vanilla/sip_profiles/internal.xml
index 0f4cabe32d..7d37da863e 100644
--- a/conf/vanilla/sip_profiles/internal.xml
+++ b/conf/vanilla/sip_profiles/internal.xml
@@ -222,7 +222,7 @@
     <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
     <param name="inbound-late-negotiation" value="true"/>
 
-    <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+    <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
     <param name="inbound-zrtp-passthru" value="true"/>
 
     <!-- this lets anything register -->
diff --git a/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml b/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
index 30d8063a67..2e66602f1b 100644
--- a/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
+++ b/src/mod/endpoints/mod_sofia/conf/sofia.conf.xml
@@ -266,7 +266,7 @@
         <!-- Let calls hit the dialplan before selecting codec for the a-leg -->
         <param name="inbound-late-negotiation" value="true"/>
 
-        <!-- Allow ZRTP clients to negotiate end-to-end security associations -->
+        <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) -->
         <param name="inbound-zrtp-passthru" value="true"/>
 
         <!-- this lets anything register -->