diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 896ad222565..0871306b202 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -39,7 +39,10 @@
     url="https://systemd.io/USER_RECORD">JSON User Records</ulink> and <ulink
     url="https://systemd.io/GROUP_RECORD">JSON Group Records</ulink> definitions), and classic UNIX NSS/glibc
     user and group records. This tool is primarily a client to the <ulink
-    url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via Varlink</ulink>.</para>
+    url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via Varlink</ulink>, and may also
+    pick up drop-in JSON user and group records from <filename>/etc/userdb/</filename>,
+    <filename>/run/userdb/</filename>, <filename>/run/host/userdb/</filename>,
+    <filename>/use/lib/userdb/</filename>.</para>
   </refsect1>
 
   <refsect1>
@@ -86,6 +89,27 @@
         are included in the output (which is the default).</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--with-varlink=</option><replaceable>BOOL</replaceable></term>
+
+        <listitem><para>Controls whether to include Varlink user/group lookups in the output, i.e. those done
+        via the <ulink url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via
+        Varlink</ulink>. If <option>--with-varlink=no</option> is used any attempts to resolve or enumerate
+        users/groups provided only via Varlink are suppressed. If <option>--with-varlink=yes</option> is
+        specified such users/groups are included in the output (which is the default).</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><option>--with-dropin=</option><replaceable>BOOL</replaceable></term>
+
+        <listitem><para>Controls whether to include user/group lookups in the output that are defined using
+        drop-in files in <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
+        <filename>/run/host/userdb/</filename>, <filename>/use/lib/userdb/</filename>. If
+        <option>--with-dropin=no</option> is used these records are suppressed. If
+        <option>--with-dropin=yes</option> is specified such users/groups are included in the output (which
+        is the default).</para></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
 
@@ -228,6 +252,17 @@
         data, however the NSS/glibc APIs necessarily expose a more reduced set of fields
         only.</para></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><constant>io.systemd.DropIn</constant></term>
+
+        <listitem><para>This service is (also) provided by
+        <citerefentry><refentrytitle>systemd-userdbd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        and picks up JSON user/group records from <filename>/etc/userdb/</filename>,
+        <filename>/run/userdb/</filename>, <filename>/run/host/userdb/</filename>,
+        <filename>/use/lib/userdb/</filename>.</para></listitem>
+      </varlistentry>
+
     </variablelist>
 
     <para>Note that <command>userdbctl</command> has internal support for NSS-based lookups too. This means