diff --git a/src/content/docs/en/reference/configuration-reference.mdx b/src/content/docs/en/reference/configuration-reference.mdx
index 27f20b8fe7e83..d0de45d7d9c08 100644
--- a/src/content/docs/en/reference/configuration-reference.mdx
+++ b/src/content/docs/en/reference/configuration-reference.mdx
@@ -1107,6 +1107,18 @@ When `true`, all URLs will display a language prefix.
 URLs will be of the form `example.com/[locale]/content/` for every route, including the default language.
 Localized folders are used for every language, including the default.
 
+```js
+export default defineConfig({
+	i18n: {
+		defaultLocale: "en",
+		locales: ["en", "fr", "pt-br", "es"],
+		routing: {
+			prefixDefaultLocale: true,
+		}
+	}
+})
+```
+
 #### i18n.routing.redirectToDefaultLocale
 
 <p>
@@ -1134,6 +1146,30 @@ export default defineConfig({
 })
 ```
 
+#### i18n.routing.manual
+
+<p>
+
+**Type:** `string`<br />
+<Since v="4.6.0" />
+</p>
+
+When this option is enabled, Astro will **disable** its i18n middleware so that you can implement your own custom logic. No other `routing` options (e.g. `prefixDefaultLocale`) may be configured with `routing: "manual"`.
+
+You will be responsible for writing your own routing logic, or executing Astro's i18n middleware manually alongside your own.
+
+```js
+export default defineConfig({
+	i18n: {
+		defaultLocale: "en",
+		locales: ["en", "fr", "pt-br", "es"],
+		routing: {
+			prefixDefaultLocale: true,
+		}
+	}
+})
+```
+
 ## Legacy Flags
 
 To help some users migrate between versions of Astro, we occasionally introduce `legacy` flags.
@@ -1344,3 +1380,30 @@ Both page routes built and URLs returned by the `astro:i18n` helper functions [`
 
 See the [Internationalization Guide](/en/guides/internationalization/#domains-experimental) for more details, including the limitations of this experimental feature.
 
+### experimental.security
+
+<p>
+
+**Type:** `boolean`<br />
+**Default:** `false`<br />
+<Since v="4.6.0" />
+</p>
+
+Enables CSRF protection for Astro websites.
+
+The CSRF protection works only for pages rendered on demand (SSR) using `server` or `hybrid` mode. The pages must opt out of prerendering in `hybrid` mode.
+
+```js
+// astro.config.mjs
+export default defineConfig({
+  output: "server",
+  experimental: {
+    security: {
+      csrfProtection: {
+        origin: true
+      }
+    }
+  }
+})
+```
+