diff --git a/doc/src/sgml/glossary.sgml b/doc/src/sgml/glossary.sgml
index 881026ded63..ccd480aede0 100644
--- a/doc/src/sgml/glossary.sgml
+++ b/doc/src/sgml/glossary.sgml
@@ -247,7 +247,8 @@
This role also behaves as a normal
- database superuser.
+ database superuser,
+ and its superuser status cannot be removed.
diff --git a/doc/src/sgml/ref/alter_role.sgml b/doc/src/sgml/ref/alter_role.sgml
index ab1ee45d54e..7b0a04bc463 100644
--- a/doc/src/sgml/ref/alter_role.sgml
+++ b/doc/src/sgml/ref/alter_role.sgml
@@ -69,7 +69,9 @@ ALTER ROLE { role_specification | A
GRANT and
REVOKE for that.)
Attributes not mentioned in the command retain their previous settings.
- Database superusers can change any of these settings for any role.
+ Database superusers can change any of these settings for any role, except
+ for changing the SUPERUSER property for the
+ bootstrap superuser.
Non-superuser roles having CREATEROLE privilege can
change most of these properties, but only for non-superuser and
non-replication roles for which they have been granted
diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
index 92a299d2d33..1c011ac62b5 100644
--- a/doc/src/sgml/user-manag.sgml
+++ b/doc/src/sgml/user-manag.sgml
@@ -350,7 +350,7 @@ ALTER ROLE myname SET enable_indexscan TO off;
options. Thus, the fact that privileges are not inherited by default nor
is SET ROLE granted by default is a safeguard against
accidents, not a security feature. Also note that, because this automatic
- grant is granted by the bootstrap user, it cannot be removed or changed by
+ grant is granted by the bootstrap superuser, it cannot be removed or changed by
the CREATEROLE user; however, any superuser could
revoke it, modify it, and/or issue additional such grants to other
CREATEROLE users. Whichever CREATEROLE
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index 7e815897116..7a9c177b21c 100644
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -868,7 +868,7 @@ AlterRole(ParseState *pstate, AlterRoleStmt *stmt)
ereport(ERROR,
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
errmsg("permission denied to alter role"),
- errdetail("The bootstrap user must have the %s attribute.",
+ errdetail("The bootstrap superuser must have the %s attribute.",
"SUPERUSER")));
new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(should_be_super);