diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index a7c1a0e1d..66fcf950a 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -76,6 +76,7 @@ bzlib
 CACERTDIR
 CANTCREAT
 CApath
+CCNAME
 cdb
 certbot
 changetype
@@ -187,6 +188,7 @@ eddsa
 editheader
 edprivkey
 edpubkey
+edu
 egid
 EID
 Eing
@@ -343,6 +345,7 @@ kludgy
 kmail
 krb
 ktadd
+KTNAME
 ktpass
 ktrace
 KTY
diff --git a/data/settings.js b/data/settings.js
index 48e0fef40..4dfd7e10a 100644
--- a/data/settings.js
+++ b/data/settings.js
@@ -191,6 +191,38 @@ checked already when the client is created (e.g. when the namespace is initializ
 not only when connecting.`
 	},
 
+	client_auth_gssapi_channel_binding: {
+		added: {
+			settings_client_auth_added: false
+		},
+		tags: [ 'client-auth' ],
+		seealso: [ 'client_auth', '[[link,auth_gssapi]]' ],
+		values: setting_types.BOOLEAN,
+		default: 'yes',
+		text: `
+Whether the \`GSSAPI\` and \`GSS-SPNEGO\` client mechanisms send a TLS channel
+binding. It is normally set inside the mechanism's [[setting,client_auth]]
+filter, where the prefix is dropped:
+
+\`\`\`[dovecot.conf]
+imapc {
+  client_auth GSSAPI {
+    gssapi_channel_binding = no
+  }
+}
+\`\`\`
+
+If enabled and the connection uses TLS, the [[rfc,5929]]
+\`tls-server-end-point\` channel binding is passed to the Kerberos library. If
+the binding can't be obtained, the authentication fails. This happens with
+certificates whose signature algorithm has no single hash, such as Ed25519 and
+Ed448. Active Directory with \`LdapEnforceChannelBinding=2\` requires the
+binding, while servers that don't check channel bindings ignore it.
+
+Without TLS no channel binding is sent. If disabled, no channel binding is sent
+at all.`
+	},
+
 	client_auth_mechanism: {
 		added: {
 			settings_client_auth_added: false
@@ -210,6 +242,8 @@ Supported mechanisms are:
  * CRAM-MD5
  * DIGEST-MD5
  * EXTERNAL
+ * GSS-SPNEGO
+ * GSSAPI
  * LOGIN
  * OAUTHBEARER
  * PLAIN
@@ -219,8 +253,11 @@ Supported mechanisms are:
  * SCRAM-SHA-256-PLUS
  * XOAUTH2
 
-Note that [[setting,client_auth_password]] is ignored for \`ANONYMOUS\` and
-\`EXTERNAL\` mechanisms. For \`OAUTHBEARER\` and \`XOAUTH2\`
+Note that [[setting,client_auth_password]] is ignored for \`ANONYMOUS\`,
+\`EXTERNAL\`, \`GSSAPI\` and \`GSS-SPNEGO\` mechanisms. The last two use
+Kerberos credentials instead, and are available only if Dovecot was built with
+GSSAPI support. They are loaded from the \`libdovecot-gssapi\` module when
+configured. See [[link,auth_gssapi]]. For \`OAUTHBEARER\` and \`XOAUTH2\`
 [[setting,client_auth_password]] should be a bearer token.
 
 Normally this setting is not set directly, but through the name of a
diff --git a/docs/core/config/auth/mechanisms/gssapi.md b/docs/core/config/auth/mechanisms/gssapi.md
index 82d545a0c..dcce79a31 100644
--- a/docs/core/config/auth/mechanisms/gssapi.md
+++ b/docs/core/config/auth/mechanisms/gssapi.md
@@ -107,3 +107,21 @@ authentication mechanism and you should be able to log in.
 
 If necessary, you can use [[setting,auth_username_format]] to normalize
 usernames.
+
+## Using GSSAPI as a Client
+
+Dovecot can also authenticate as a GSSAPI or GSS-SPNEGO client, e.g. when
+proxying. See [[link,client_auth]].
+
+ * The Kerberos credentials come from the process's default credential cache
+   (`KRB5CCNAME`) or from the client keytab (`KRB5_CLIENT_KTNAME` or
+   `default_client_keytab_name`, see
+   [MIT Kerberos](https://web.mit.edu/kerberos/krb5-latest/doc/basic/keytab_def.html)).
+   The environment variables must be passed to the process with
+   [[setting,import_environment]].
+ * Proxying with GSSAPI from a login process requires a non-chrooted login
+   service, because a chrooted process can't reach `krb5.conf`, the credential
+   cache or the GSSAPI module.
+ * As a client GSS-SPNEGO negotiates only Kerberos, never NTLM.
+ * Over TLS a channel binding is sent by default. See
+   [[setting,client_auth_gssapi_channel_binding]].