diff --git a/CHANGELOG.md b/CHANGELOG.md
index f051d1d3c76..ccda87c3eb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,11 @@
   containing vhost-user block devices.
   See the [related doc page](./docs/api_requests/block-vhost-user.md) for details.
   The device emits metrics under the label `"vhost_user_{device}_{drive_id}"`.
+- Document [a caveat to the jailer][1] when using the `--parent-cgroup` option,
+  which results in it being ignored by the jailer. Refer to the [jailer
+  documentation](./docs/jailer.md#caveats) for a workaround.
+
+[1]: https://github.com/firecracker-microvm/firecracker/issues/4287
 
 ### Changed
 
diff --git a/docs/jailer.md b/docs/jailer.md
index 59a783b8e25..99ed6465e97 100644
--- a/docs/jailer.md
+++ b/docs/jailer.md
@@ -282,3 +282,8 @@ Note: default value for `<api-sock>` is `/run/firecracker.socket`.
 - If all the cgroup controllers are bunched up on a single mount point using
   the "all" option, our current program logic will complain it cannot detect
   individual controller mount points.
+
+- [#4287](https://github.com/firecracker-microvm/firecracker/issues/4287) When
+  starting a jailer with `--parent-cgroup` specified but no cgroup flags
+  specified, then the rules in the parent cgroup folder are ignored. To
+  work around, use a dummy cgroup parameter like `--cgroup=memory.max=max`.