diff --git a/README.md b/README.md
index 873ff46..d0956b7 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,19 @@ gst-meet --web-socket-url=wss://your.jitsi.domain/xmpp-websocket \
                           videodemux.video_0 ! queue ! clocksync name=video"
 ```
 
+## Feature flags
+
+By default, the system native TLS library is used. This can be turned off by passing `--no-default-features` to Cargo, and one of the following features can be enabled:
+
+```
+tls-native-tls             (the default) link to the system native TLS library
+tls-native-tls-vendored    automatically build a copy of OpenSSL and statically link to it
+tls-rustls                 use rustls for TLS (note that rustls may not accept some server certificates)
+```
+
+These options only affect the TLS library used for the WebSocket connections (to the XMPP server and to the JVB).
+Gstreamer uses its own choice of TLS library for its elements, including DTLS-SRTP (the media streams).
+
 ## Debugging
 
 It can sometimes be tricky to get GStreamer pipeline syntax and structure correct. To help with this, you can try setting the `GST_DEBUG` environment variable (for example, `3` is modestly verbose, while `6` produces copious per-packet output). You can also set `GST_DEBUG_DUMP_DOT_DIR` to the relative path to a directory (which must already exist). `.dot` files containing the pipeline graph will be saved to this directory, and can be converted to `.png` with the `dot` tool from GraphViz; for example `dot filename.dot -Tpng > filename.png`.