diff --git a/documentation/web/docs/user/backup_and_restore.md b/documentation/web/docs/user/backup_and_restore.md
index d14871cb..8943ce33 100644
--- a/documentation/web/docs/user/backup_and_restore.md
+++ b/documentation/web/docs/user/backup_and_restore.md
@@ -240,7 +240,7 @@ spec:
   clientSecretName: my-client-credentials
   serverSecretName: klio-server-tls
 
-  # Optional: specify the original cluster name if different
+  # Required: the name of the original cluster that was backed up
   clusterName: my-cluster
 ```
 
diff --git a/documentation/web/docs/user/plugin_configuration.md b/documentation/web/docs/user/plugin_configuration.md
index 075e5f16..0ccde4ed 100644
--- a/documentation/web/docs/user/plugin_configuration.md
+++ b/documentation/web/docs/user/plugin_configuration.md
@@ -403,6 +403,12 @@ server hits the same error, since the original cluster backups and
 WALs will still exist on the Klio server.
 :::
 
+Whichever value you use, it must match the host name in the Common Name of the
+client certificate (`userName@hostName`). For tier 1 base backups, a mismatch
+is rejected at connection time; for WAL streaming, a mismatch is not currently
+detected and can lead to WALs being stored or retrieved under the wrong
+cluster path.
+
 ### Tier 2 configuration
 
 Tier 2 provides secondary storage (typically object storage like S3) for
diff --git a/operator/internal/klioconfig/config.go b/operator/internal/klioconfig/config.go
index 04ade284..89b43d0d 100644
--- a/operator/internal/klioconfig/config.go
+++ b/operator/internal/klioconfig/config.go
@@ -87,7 +87,6 @@ const ConfigDataKey = "config.yaml"
 
 // GenerateConfig builds a config.Data from a PluginConfigurationSpec.
 // configKey is the configuration key (e.g. "klio-archive").
-// clusterName is the default cluster name when the PC doesn't set one.
 func GenerateConfig(
 	spec kliov1alpha1.PluginConfigurationSpec,
 	configKey string,
@@ -252,9 +251,6 @@ func addExternalClusterConfiguration(
 		return fmt.Errorf("failed to get '%s' configuration, error: %w", ref, err)
 	}
 
-	if klioPluginConfiguration.Spec.ClusterName == "" {
-		klioPluginConfiguration.Spec.ClusterName = serverName
-	}
 	configurations[serverName].klioPluginConfiguration = klioPluginConfiguration
 
 	return nil
@@ -312,11 +308,6 @@ func getArchivePluginConfigurations(
 
 		return configurations, fmt.Errorf("failed to get '%s' configuration, error: %w", ref, err)
 	}
-	if klioPluginConfiguration.Spec.ClusterName == "" {
-		// if the host name is not set, use the cluster name as the host name
-		klioPluginConfiguration.Spec.ClusterName = cluster.Name
-	}
-
 	configurations[ArchiveConfigKey].klioPluginConfiguration = klioPluginConfiguration.DeepCopy()
 
 	return configurations, nil