diff --git a/sysadm/user-management/onboarding.rst b/sysadm/user-management/onboarding.rst
--- a/sysadm/user-management/onboarding.rst
+++ b/sysadm/user-management/onboarding.rst
@@ -60,6 +60,7 @@
 - HTTP auth credentials for the `intranet wiki`_
 - Create account on the `intranet wiki`_ and ask someone to give you the shared auth credentials
 - Create account on the `public wiki`_
+- add "staff" role from production and staging user accounts on Keycloak
 
 Extra steps for sysadm:
 
diff --git a/sysadm/user-management/outboarding.rst b/sysadm/user-management/outboarding.rst
--- a/sysadm/user-management/outboarding.rst
+++ b/sysadm/user-management/outboarding.rst
@@ -38,6 +38,7 @@
 - revoke `VPN
   <https://intranet.softwareheritage.org/wiki/VPN#Revoking_a_client_certificate>`_
   certificate
+- remove "staff" role (and others) from production and staging user accounts on Keycloak
 
 .. _outboarding_development: