diff --git a/salt/docker/soc_docker.yaml b/salt/docker/soc_docker.yaml
index 18a7278a5..a3b11ecc5 100644
--- a/salt/docker/soc_docker.yaml
+++ b/salt/docker/soc_docker.yaml
@@ -8,15 +8,39 @@ docker:
     helpLink: docker
     advanced: True
   networks:
-    description: |
-      Docker networks used by the grid. sobridge carries most containers and takes its range and
-      gateway from the docker.range and docker.gateway settings above. soauth is an isolated
-      network for the authentication services, so that the Kratos admin and Hydra API is only reachable
-      from the containers placed on it.
-    helpLink: docker
-    readonly: True
-    advanced: True
-    global: True
+    sobridge:
+      description: |
+        The default docker network, carrying most containers. Its range and gateway are taken
+        from the docker.range and docker.gateway settings above rather than set here.
+      helpLink: docker
+      readonly: True
+      advanced: True
+      global: True
+    soauth:
+      range:
+        description: |
+          IP range for the soauth docker network, an isolated network for the authentication
+          services, so that the Kratos and Hydra admin APIs are only reachable from the
+          containers placed on it.
+        helpLink: docker
+        readonly: True
+        advanced: True
+        global: True
+      gateway:
+        description: Gateway for the soauth docker network.
+        helpLink: docker
+        readonly: True
+        advanced: True
+        global: True
+      manager_only:
+        description: |
+          Limits the soauth network to grid members running the authentication containers,
+          instead of creating it on every node.
+        helpLink: docker
+        readonly: True
+        advanced: True
+        global: True
+        forcedType: bool
   ulimits:
     description: |
       Default ulimit settings applied to all containers via the Docker daemon. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with soft and hard limits. Individual container ulimits override these defaults. Valid resource names include: cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime.