diff --git a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
index 31f7874b26e..c231b03da80 100644
--- a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
+++ b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
@@ -248,6 +248,9 @@ The preceding example uses `EndpointRequest.toAnyEndpoint()` to match a request
 Several other matcher methods are also available on javadoc:org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest[].
 See the xref:api:rest/actuator/index.adoc[API documentation] for details.
 
+NOTE: When matching for Actuator endpoints, `EndpointRequest.to("endpoint")` will consider the endpoint root and all its subpaths,
+effectively matching `"/actuator/endpoint/**"` even if the endpoint does not declare nested routes.
+
 If you deploy applications behind a firewall, you may prefer that all your actuator endpoints can be accessed without requiring authentication.
 You can do so by changing the configprop:management.endpoints.web.exposure.include[] property, as follows:
 
diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
index 46601f6cccc..6cf0f6b9027 100644
--- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
+++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
@@ -69,11 +69,12 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes all {@link Endpoint actuator endpoints}. It also
-	 * includes the links endpoint which is present at the base path of the actuator
-	 * endpoints. The {@link EndpointServerWebExchangeMatcher#excluding(Class...)
-	 * excluding} method can be used to further remove specific endpoints if required. For
-	 * example: <pre class="code">
+	 * Returns a matcher that includes all {@link Endpoint actuator endpoints} and
+	 * everything beneath them. It also includes the links endpoint which is present at
+	 * the base path of the actuator endpoints. The
+	 * {@link EndpointServerWebExchangeMatcher#excluding(Class...) excluding} method can
+	 * be used to further remove specific endpoints if required. For example:
+	 * <pre class="code">
 	 * EndpointRequest.toAnyEndpoint().excluding(ShutdownEndpoint.class)
 	 * </pre>
 	 * @return the configured {@link ServerWebExchangeMatcher}
@@ -83,8 +84,8 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
-	 * For example: <pre class="code">
+	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
+	 * everything beneath them. For example: <pre class="code">
 	 * EndpointRequest.to(ShutdownEndpoint.class, HealthEndpoint.class)
 	 * </pre>
 	 * @param endpoints the endpoints to include
@@ -95,8 +96,8 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
-	 * For example: <pre class="code">
+	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
+	 * everything beneath them. For example: <pre class="code">
 	 * EndpointRequest.to("shutdown", "health")
 	 * </pre>
 	 * @param endpoints the endpoints to include
diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
index 3f6f50a03f0..b78109e3598 100644
--- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
+++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
@@ -67,11 +67,11 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes all {@link Endpoint actuator endpoints}. It also
-	 * includes the links endpoint which is present at the base path of the actuator
-	 * endpoints. The {@link EndpointRequestMatcher#excluding(Class...) excluding} method
-	 * can be used to further remove specific endpoints if required. For example:
-	 * <pre class="code">
+	 * Returns a matcher that includes all {@link Endpoint actuator endpoints} and
+	 * everything beneath them. It also includes the links endpoint which is present at
+	 * the base path of the actuator endpoints. The
+	 * {@link EndpointRequestMatcher#excluding(Class...) excluding} method can be used to
+	 * further remove specific endpoints if required. For example: <pre class="code">
 	 * EndpointRequest.toAnyEndpoint().excluding(ShutdownEndpoint.class)
 	 * </pre>
 	 * @return the configured {@link RequestMatcher}
@@ -81,8 +81,8 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
-	 * For example: <pre class="code">
+	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
+	 * and everything beneath them. For example: <pre class="code">
 	 * EndpointRequest.to(ShutdownEndpoint.class, HealthEndpoint.class)
 	 * </pre>
 	 * @param endpoints the endpoints to include
@@ -93,8 +93,8 @@ public final class EndpointRequest {
 	}
 
 	/**
-	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
-	 * For example: <pre class="code">
+	 * Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
+	 * and everything beneath them. For example: <pre class="code">
 	 * EndpointRequest.to("shutdown", "health")
 	 * </pre>
 	 * @param endpoints the endpoints to include