diff --git a/.changeset/mysql-ssl-doc-comment-verbatim.md b/.changeset/mysql-ssl-doc-comment-verbatim.md
new file mode 100644
index 0000000000..af024d7a2c
--- /dev/null
+++ b/.changeset/mysql-ssl-doc-comment-verbatim.md
@@ -0,0 +1,5 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): correct the stale "passed to `mysql2` verbatim" TS doc comment on `MysqlConfigSchema.ssl` (mysql.zod.ts) — since #8874, the resolved `true` is translated into mysql2's own default TLS options (`rejectUnauthorized: true`) before mysql2 sees it, because mysql2 rejects a bare boolean outright. Comment-only; accept/reject behaviour is unchanged, and the shared `DriverSslToggleSchema.describe()` (correct for the postgres/turso arms, which do pass the boolean verbatim) is untouched (#9125)
diff --git a/packages/spec/src/data/driver/mysql.zod.ts b/packages/spec/src/data/driver/mysql.zod.ts
index e415719dcf..c6d88ed013 100644
--- a/packages/spec/src/data/driver/mysql.zod.ts
+++ b/packages/spec/src/data/driver/mysql.zod.ts
@@ -112,7 +112,12 @@ export const MysqlConfigSchema = lazySchema(() => strictObject(
    */
   password: refusedInlineCredentialKey('password', 'Password'),
 
-  /** TLS settings, passed to `mysql2` verbatim. */
+  /**
+   * TLS on/off. `true` reaches `mysql2` as its own default TLS options
+   * (`rejectUnauthorized: true`), not the bare boolean — mysql2 rejects a
+   * boolean outright (#8874). Certificates and verification live in the
+   * datasource-level `ssl` block.
+   */
   ssl: DriverSslToggleSchema.optional().meta({ title: 'Use SSL/TLS' }),
 
   /** Dev-only, loosen-only schema self-heal (#2186). */