diff --git a/admin/make-tarball.txt b/admin/make-tarball.txt
index 872cb00ca2..c56c887e19 100644
--- a/admin/make-tarball.txt
+++ b/admin/make-tarball.txt
@@ -187,7 +187,7 @@ General steps (for each step, check for possible errors):
 8.  You can now tag the release/pretest and push it together with the
     last commit:
 
-     cd EMACS_ROOT_DIR && git tag -a TAG -m "Emacs TAG"
+     cd EMACS_ROOT_DIR && git tag -a -s TAG -m "Emacs TAG"
      git push
      git push --tags
 
@@ -199,16 +199,20 @@ General steps (for each step, check for possible errors):
     use the SHA1 of the last commit which went into the release
     tarball, in case there were some intervening commits since then:
 
-     git tag -a TAG -m "Emacs TAG" SHA1
+     git tag -a -s TAG -m "Emacs TAG" SHA1
      git push --tags
 
     In the past, we were not always consistent with the annotation
     (i.e. -m "Emacs TAG").  The preferred format is like this for a
     pretest, release candidate and final release:
 
-     git tag -a emacs-28.0.90  -m "Emacs 28.0.90 pretest"
-     git tag -a emacs-28.1-rc1 -m "Emacs 28.1 RC1"
-     git tag -a emacs-28.1     -m "Emacs 28.1 release"
+     git tag -a -s emacs-28.0.90  -m "Emacs 28.0.90 pretest"
+     git tag -a -s emacs-28.1-rc1 -m "Emacs 28.1 RC1"
+     git tag -a -s emacs-28.1     -m "Emacs 28.1 release"
+
+    The "-s" option above means to sign the tag using your default GPG
+    key.  Make sure this uses the same GPG key that you use to sign
+    the release (see below).
 
 9. Decide what compression schemes to offer.
     For a release, at least gz and xz: