diff --git a/deployments/falco/README.md b/deployments/falco/README.md
index 38d765a..dcebe6e 100644
--- a/deployments/falco/README.md
+++ b/deployments/falco/README.md
@@ -29,6 +29,8 @@ kubectl create secret generic falco-alerting \
 ```
 
 The `webhook-url` key is injected into Falcosidekick as `SLACK_WEBHOOKURL`.
+Falcosidekick sends only `WARNING` and higher priority events to Slack through
+`SLACK_MINIMUMPRIORITY`. Lower-priority events remain available in Falco logs.
 The Secret is intentionally not included in the Falco
 Kustomization because ArgoCD must not manage or render the credential from
 Git.
diff --git a/deployments/falco/operator-resources/falcosidekick-component.yaml b/deployments/falco/operator-resources/falcosidekick-component.yaml
index 2cb240a..7b3a5f2 100644
--- a/deployments/falco/operator-resources/falcosidekick-component.yaml
+++ b/deployments/falco/operator-resources/falcosidekick-component.yaml
@@ -20,3 +20,7 @@ spec:
                 secretKeyRef:
                   name: falco-alerting
                   key: webhook-url
+            # Keep low-priority Falco events in cluster logs, but do not send
+            # NOTICE-level activity to the Slack alert channel.
+            - name: SLACK_MINIMUMPRIORITY
+              value: warning