diff --git a/docs/customization/custom-scripts.md b/docs/customization/custom-scripts.md
index 7e1650c52..9184678b5 100644
--- a/docs/customization/custom-scripts.md
+++ b/docs/customization/custom-scripts.md
@@ -547,7 +547,7 @@ http://netbox/api/extras/scripts/example.MyReport/ \
 Optionally `schedule_at` can be passed in the form data with a datetime string to schedule a script at the specified date and time.
 
 !!! note
-    The `data` object is validated against the script's declared variables, just as in the web UI and on the CLI. Keys which do not match a declared variable are ignored.
+    The `data` object is validated against the script's declared variables, just as in the web UI. Keys which do not match a declared variable are ignored. Scripts declaring a `FileVar` must be run via a `multipart/form-data` request, passing `data` as a JSON string alongside the uploaded file.
 
 ### Via the CLI
 
diff --git a/netbox/extras/scripts.py b/netbox/extras/scripts.py
index 5d03d9ac9..1bad08a0a 100644
--- a/netbox/extras/scripts.py
+++ b/netbox/extras/scripts.py
@@ -719,9 +719,10 @@ def prepare_script_form(script_instance, data, files=None):
     declared variable's `default` value into `data` when the caller omitted it.
 
     Used by both the UI (extras/views.py) and the REST API (extras/api/views.py) so the
-    two entry points share one contract and can't drift apart again. `runscript` deliberately
-    stays on the plain `as_form()` call, since its own test suite exercises it with bare
-    script doubles that only implement `as_form()`, not the full Script/`_get_vars()` API.
+    two entry points share one contract and can't drift apart again. `runscript` stays on the
+    plain `as_form()` call: it has never back-filled defaults, so routing it through this
+    helper would change CLI behavior (a variable with a `default` omitted from `--data` would
+    begin to be accepted rather than reported as required). That is a separate change.
 
     Note: `script_instance` must already be an *instance* (e.g. `script.python_class()`),
     not the class itself.