diff --git a/terraform/eval_apply.go b/terraform/eval_apply.go
index 5be883197..0755c6b9f 100644
--- a/terraform/eval_apply.go
+++ b/terraform/eval_apply.go
@@ -563,7 +563,10 @@ func (n *EvalApplyProvisioners) apply(ctx EvalContext, provs []*configs.Provisio
 
 		var forEach map[string]cty.Value
 
-		// We can't evaluate the for_each expression during a destroy
+		// For a destroy-time provisioner forEach is intentionally nil here,
+		// which EvalDataForInstanceKey responds to by not populating EachValue
+		// in its result. That's okay because each.value is prohibited for
+		// destroy-time provisioners.
 		if n.When != configs.ProvisionerWhenDestroy {
 			m, forEachDiags := evaluateResourceForEachExpression(n.ResourceConfig.ForEach, ctx)
 			diags = diags.Append(forEachDiags)
diff --git a/terraform/evaluate.go b/terraform/evaluate.go
index 1ce77a64f..96a981070 100644
--- a/terraform/evaluate.go
+++ b/terraform/evaluate.go
@@ -104,6 +104,11 @@ type InstanceKeyEvalData = instances.RepetitionData
 
 // EvalDataForInstanceKey constructs a suitable InstanceKeyEvalData for
 // evaluating in a context that has the given instance key.
+//
+// The forEachMap argument can be nil when preparing for evaluation
+// in a context where each.value is prohibited, such as a destroy-time
+// provisioner. In that case, the returned EachValue will always be
+// cty.NilVal.
 func EvalDataForInstanceKey(key addrs.InstanceKey, forEachMap map[string]cty.Value) InstanceKeyEvalData {
 	var evalData InstanceKeyEvalData
 	if key == nil {