diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index 3c208082f944..5d34a3fb4f15 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -95,6 +95,8 @@ X509Pointer ParseCertificate(const X509CertificateSnapshot::DER& certificate) {
 
 }  // namespace
 
+// ManagedX509 is non-copyable to prevent multiple smart pointers managing the
+// same raw pointer (Coverity 367349); ownership transfer is explicit via Adopt.
 ManagedX509::ManagedX509(X509Pointer cert) : cert_(std::move(cert)) {}
 
 std::shared_ptr<ManagedX509> ManagedX509::Adopt(X509Pointer cert) {
diff --git a/src/crypto/crypto_x509.h b/src/crypto/crypto_x509.h
index 44714d1bcca2..63a5737de063 100644
--- a/src/crypto/crypto_x509.h
+++ b/src/crypto/crypto_x509.h
@@ -24,6 +24,8 @@ class ManagedX509 final : public MemoryRetainer {
  public:
   static std::shared_ptr<ManagedX509> Adopt(ncrypto::X509Pointer cert);
 
+  // Prevent Coverity 367349: copy and copy-assignment are deleted to avoid
+  // multiple smart pointers managing the same raw pointer.
   ManagedX509(const ManagedX509&) = delete;
   ManagedX509& operator=(const ManagedX509&) = delete;