diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index ec81b7bf07..8a644a3ef2 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -165,6 +165,7 @@ (define-public p11-kit
 (define-public gnutls
   (package
     (name "gnutls")
+    ;; XXX Unversion openconnect's "gnutls" input when ungrafting.
     (replacement gnutls-3.6.13)
     (version "3.6.12")
     (source (origin
diff --git a/gnu/packages/vpn.scm b/gnu/packages/vpn.scm
index 0f0157806c..5c38ac71e8 100644
--- a/gnu/packages/vpn.scm
+++ b/gnu/packages/vpn.scm
@@ -259,6 +259,8 @@ (define-public openconnect
    (build-system gnu-build-system)
    (propagated-inputs
     `(("libxml2" ,libxml2)
+      ;; XXX ‘DTLS is insecure in GnuTLS v3.6.3 through v3.6.12.’
+      ;; See <https://gitlab.com/gnutls/gnutls/-/issues/960>.
       ("gnutls" ,gnutls-3.6.13)
       ("zlib" ,zlib)))
    (inputs