diff --git a/doc.go b/doc.go
index 5d79872..352aa4b 100644
--- a/doc.go
+++ b/doc.go
@@ -242,6 +242,12 @@ The message is printed to stdout and is in standard internet mail format.
 
 Import a maildir into an account.
 
+The mbox/maildir archive is accessed and imported by the running mox process, so
+it must have access to the archive files. The default suggested systemd service
+file isolates mox from most of the file system, with only the "data/" directory
+accessible, so you may want to put the mbox/maildir archive files in a
+directory like "data/import/" to make it available to mox.
+
 By default, messages will train the junk filter based on their flags and, if
 "automatic junk flags" configuration is set, based on mailbox naming.
 
@@ -255,9 +261,6 @@ uploading a zip or tgz file with mbox and/or maildirs.
 Mailbox flags, like "seen", "answered", will be imported. An optional
 dovecot-keywords file can specify additional flags, like Forwarded/Junk/NotJunk.
 
-The maildir files/directories are read by the mox process, so make sure it has
-access to the maildir directories/files.
-
 	usage: mox import maildir accountname mailboxname maildir
 
 # mox import mbox
@@ -266,6 +269,12 @@ Import an mbox into an account.
 
 Using mbox is not recommended, maildir is a better defined format.
 
+The mbox/maildir archive is accessed and imported by the running mox process, so
+it must have access to the archive files. The default suggested systemd service
+file isolates mox from most of the file system, with only the "data/" directory
+accessible, so you may want to put the mbox/maildir archive files in a
+directory like "data/import/" to make it available to mox.
+
 By default, messages will train the junk filter based on their flags and, if
 "automatic junk flags" configuration is set, based on mailbox naming.
 
@@ -276,9 +285,6 @@ recipients to be accepted, unless other reputation signals prevent that.
 Users can also import mailboxes/messages through the account web page by
 uploading a zip or tgz file with mbox and/or maildirs.
 
-The mailbox is read by the mox process, so make sure it has access to the
-maildir directories/files.
-
 	usage: mox import mbox accountname mailboxname mbox
 
 # mox export maildir
diff --git a/import.go b/import.go
index c25e806..c1f5dc7 100644
--- a/import.go
+++ b/import.go
@@ -27,7 +27,13 @@ import (
 
 // todo: add option to trust imported messages, causing us to look at Authentication-Results and Received-SPF headers and add eg verified spf/dkim/dmarc domains to our store, to jumpstart reputation.
 
-const importCommonHelp = `By default, messages will train the junk filter based on their flags and, if
+const importCommonHelp = `The mbox/maildir archive is accessed and imported by the running mox process, so
+it must have access to the archive files. The default suggested systemd service
+file isolates mox from most of the file system, with only the "data/" directory
+accessible, so you may want to put the mbox/maildir archive files in a
+directory like "data/import/" to make it available to mox.
+
+By default, messages will train the junk filter based on their flags and, if
 "automatic junk flags" configuration is set, based on mailbox naming.
 
 If the destination mailbox is the Sent mailbox, the recipients of the messages
@@ -45,9 +51,6 @@ func cmdImportMaildir(c *cmd) {
 ` + importCommonHelp + `
 Mailbox flags, like "seen", "answered", will be imported. An optional
 dovecot-keywords file can specify additional flags, like Forwarded/Junk/NotJunk.
-
-The maildir files/directories are read by the mox process, so make sure it has
-access to the maildir directories/files.
 `
 	args := c.Parse()
 	if len(args) != 3 {
@@ -63,11 +66,7 @@ func cmdImportMbox(c *cmd) {
 
 Using mbox is not recommended, maildir is a better defined format.
 
-` + importCommonHelp + `
-
-The mailbox is read by the mox process, so make sure it has access to the
-maildir directories/files.
-`
+` + importCommonHelp
 	args := c.Parse()
 	if len(args) != 3 {
 		c.Usage()