diff --git a/securing_apps/topics/oidc/java/installed-adapter.adoc b/securing_apps/topics/oidc/java/installed-adapter.adoc
index 15ce703485..a47a8f32cb 100644
--- a/securing_apps/topics/oidc/java/installed-adapter.adoc
+++ b/securing_apps/topics/oidc/java/installed-adapter.adoc
@@ -57,9 +57,9 @@ The `KeycloakInstalled` adapter provides support for renewal of stale tokens.
 The application needs to be configured as a `public` OpenID Connect client with
 `Standard Flow Enabled` and pass:[http://localhost:*] as an allowed `Valid Redirect URI`.
 
-TIP: The `KeycloakInstalled` adapter supports the `PKCE` mechanism to provide additional protection during 
+TIP: The `KeycloakInstalled` adapter supports the `PKCE` [RFC 7636] mechanism to provide additional protection during 
 code to token exchanges in the `OIDC` protocol. PKCE can be enabled with the `"enable-pkce": true` setting 
-in the adapter configuration. Enabling PKCE is highly recommended.
+in the adapter configuration. Enabling PKCE is highly recommended, to avoid code injection and code replay attacks.
 
 ===== Usage