diff --git a/eessi_container.sh b/eessi_container.sh
index 4b7b4eb719..9d2ce6c25f 100755
--- a/eessi_container.sh
+++ b/eessi_container.sh
@@ -70,7 +70,8 @@ export EESSI_REPOS_CFG_FILE="${EESSI_REPOS_CFG_DIR}/repos.cfg"
 display_help() {
   echo "usage: $0 [OPTIONS] [[--] SCRIPT or COMMAND]"
   echo " OPTIONS:"
-  echo "  -a | --access {ro,rw}   - ro (read-only), rw (read & write) [default: ro]"
+  echo "  -a | --access {ro,rw}   - sets access globally for all CVMFS repositories:"
+  echo "                            ro (read-only), rw (read & write) [default: ro]"
   echo "  -b | --extra-bind-paths - specify extra paths to be bound into the container."
   echo "                            To specify multiple bind paths, separate by comma."
   echo "                            Example: '/src:/dest:ro,/src2:/dest2:rw'"
@@ -89,7 +90,9 @@ display_help() {
   echo "                            MODE==install for a CUDA installation, MODE==run to"
   echo "                            attach a GPU, MODE==all for both [default: false]"
   echo "  -r | --repository CFG   - configuration file or identifier defining the"
-  echo "                            repository to use; can be given multiple times"
+  echo "                            repository to use; can be given multiple times;"
+  echo "                            CFG may include a suffix ';access={ro,rw}' to"
+  echo "                            overwrite the global access mode for this repository"
   echo "                            [default: software.eessi.io via CVMFS config available"
   echo "                            via default container, see --container]"
   echo "  -u | --resume DIR/TGZ   - resume a previous run from a directory or tarball,"