diff --git a/docs/cli/index.md b/docs/cli/index.md
index 027cf4c499..6b5f96f113 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -126,6 +126,9 @@ For the macOS you can also use seamless virtualization via [Lima](https://lima-v
 
 ## Commands
 
+See [CLI configuration](/docs/configuration/jobs#cli-configuration) for which
+configuration values CLI commands use and which commands read job-level values.
+
 * [build](/docs/cli/build/)
 * [create-update](/docs/cli/create-update/)
 * [init](/docs/cli/init/)
diff --git a/docs/configuration/actions.md b/docs/configuration/actions.md
index 76ab89e5d1..7d9b7f463c 100644
--- a/docs/configuration/actions.md
+++ b/docs/configuration/actions.md
@@ -40,7 +40,9 @@ e.g. cloning an upstream repo.
 
 Like other keys, the `actions` can be defined on the top, package or job level.
 Be aware that when overriding, the whole `actions` mapping is replaced
-instead of merging per action.
+instead of merging per action. Job-level `actions` apply to Packit Service jobs;
+ordinary CLI commands use the top-level or package-level `actions` (see
+[CLI configuration](/docs/configuration/jobs#cli-configuration)).
 
 For example, with `actions` defined both at the top level and in a job:
 
diff --git a/docs/configuration/index.md b/docs/configuration/index.md
index c6dcbfd397..453c30a7f1 100644
--- a/docs/configuration/index.md
+++ b/docs/configuration/index.md
@@ -15,6 +15,10 @@ You should place the file in the root of your upstream repo. Packit accepts thes
 * `packit.yml`
 
 Both Packit Service and Packit CLI use this configuration file.
+Ordinary CLI commands use top-level or package-level values for keys shared with
+jobs, rather than job-level overrides. See
+[CLI configuration and exceptions](/docs/configuration/jobs#cli-configuration)
+for the commands that read job-level values.
 
 :::tip Writing complex configurations
 
diff --git a/docs/configuration/jobs.md b/docs/configuration/jobs.md
index afbf835349..41e5cb866a 100644
--- a/docs/configuration/jobs.md
+++ b/docs/configuration/jobs.md
@@ -202,6 +202,42 @@ jobs:
 In this example, the job `some-job` would override [`specfile_path`](/docs/configuration#specfile_path) to
 `somewhere/else/package.spec` instead of using `./package.spec`.
 
+### CLI configuration
+
+Job-level values of keys also available at the top level, such as `actions`,
+`version_update_mask` and `notifications`, are accepted and validated when the
+configuration is loaded. They become part of that job's effective configuration,
+following the override rules above. Packit Service selects the matching job and
+uses its effective configuration.
+
+Ordinary Packit CLI commands use the package configuration instead: top-level
+values, or package-level values when using `packages`. For example, if you set
+different `actions` or `version_update_mask` values at the top level and in a job,
+the ordinary CLI workflow uses the top-level value. Valid job-level overrides
+do not change that workflow. Invalid job-level values can still make loading or
+validation fail, even when a valid value would not be used by the CLI.
+
+The following CLI commands read job-level values:
+
+* `packit prepare-sources --job-config-index N` uses the effective configuration
+  of the job at index N (0-based) instead of the package configuration, and
+  executes its `actions` as needed. A job with multiple triggers counts once per
+  trigger; with `packages`, only jobs associated with each package are counted.
+  This is an internal option used by Packit Service.
+* The experimental `packit build in-image-builder` uses the first
+  `vm_image_build` job by default, or the job at `--job-config-index` (counting
+  all jobs for the package after expanding multiple triggers), which must be a
+  `vm_image_build` job, and reads its image settings.
+* `packit propose-downstream` and `packit pull-from-upstream` read the matching
+  job's `dist_git_branches`.
+* `packit build in-copr` reads the first qualifying Copr job's `project` when
+  no `--project` option is given.
+* `packit validate` and `packit config validate` validate job-level values.
+  Invalid values fail validation; valid values do not change the CLI workflow.
+
+CLI options, such as `--project` and branch options, take precedence over both
+package-level and job-level configuration values.
+
 ## Supported jobs
 
 * Upstream jobs