diff --git a/docs/how-to/aws-sso/native-sso-setup.md b/docs/how-to/aws-sso/native-sso-setup.md
index 21b1c436..c221458f 100644
--- a/docs/how-to/aws-sso/native-sso-setup.md
+++ b/docs/how-to/aws-sso/native-sso-setup.md
@@ -111,8 +111,17 @@ This will setup a profile called `my-account` with my `inf-admin-t4` admin acces
 AWS Organizations uses the commercial linked account alias, so you will not see an account like `ent-gov-shared-sa-prod`, but insteaad it will be its associated
 account `ent-ew-shared-sa-prod`.
 
+If you are using CLI v2.22 or later, you will need to add `--use-device-code`.  A change was made in 2.22 to make PKCE the default, which makes a call to OIDC and will faile the callback from a command line.  See
+https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html for more details:
+
+> Proof Key for Code Exchange (PKCE) authorization is used by default for the AWS CLI starting with version 2.22.0 and must be used on devices with a browser. To continue to use Device authorization, append the --use-device-code option.
+>
+> `$ aws configure sso --use-device-code`
+
+
 ```console
 % aws configure sso --profile my-account --no-browser
+# % aws configure sso --profile my-account --no-browser --use-device-code	# for CLI 2.22 and later
 SSO session name (Recommended): ent-gov
 Browser will not be automatically opened.
 Please visit the following URL:
@@ -187,3 +196,6 @@ aws --profile my-account-eks whoami
 
 * 1.0.1 -- 2024-03-19
   - add bit about profile ent-gov and daily login
+
+* 1.0.2 -- 2025-02-10
+  - update docs for changes in CLI v2.22