diff --git a/RELEASENOTES.md b/RELEASENOTES.md
index 7220a130..311acf63 100644
--- a/RELEASENOTES.md
+++ b/RELEASENOTES.md
@@ -1 +1,2 @@
 - Update `bbs2gh inventory-report` help text to document that personal repositories owned by users are not supported
+- Update `ado2gh lock-repo` help text to document the scopes required for your Azure DevOps personal access token
\ No newline at end of file
diff --git a/src/ado2gh/Commands/LockRepo/LockRepoCommand.cs b/src/ado2gh/Commands/LockRepo/LockRepoCommand.cs
index 1da1bb7d..068b537b 100644
--- a/src/ado2gh/Commands/LockRepo/LockRepoCommand.cs
+++ b/src/ado2gh/Commands/LockRepo/LockRepoCommand.cs
@@ -34,7 +34,10 @@ public LockRepoCommand() : base(
         {
             IsRequired = true
         };
-        public Option<string> AdoPat { get; } = new("--ado-pat");
+        public Option<string> AdoPat { get; } = new("--ado-pat")
+        {
+            Description = "An Azure DevOps personal access token with the 'Identity -> Read' and 'Security -> Manage' scopes."
+        };
         public Option<bool> Verbose { get; } = new("--verbose");
 
         public override LockRepoCommandHandler BuildHandler(LockRepoCommandArgs args, IServiceProvider sp)