diff --git a/configs/network/network_rootless b/configs/network/network_rootless
index 5067a20..45bd106 100644
--- a/configs/network/network_rootless
+++ b/configs/network/network_rootless
@@ -2,4 +2,4 @@
 # Rootless Networking - Network stack and behaviour for rootless Docker **ADVANCED**
 # ================================================================================
 
-CFG_ROOTLESS_NET=slirp4netns                             # Rootless Network Driver - Network stack for rootless Docker; slirp4netns (default): reliable everywhere; pasta: faster and preserves the real client source IP BUT on Debian the shipped passt AppArmor profile denies the ptrace it needs to open the container netns, so the daemon won't start unless that profile is relaxed. The matching rootlesskit port driver is selected automatically. **ADVANCED** [slirp4netns:slirp4netns (default, reliable)|pasta:Pasta (faster, needs AppArmor override)]
+CFG_ROOTLESS_NET=pasta                                   # Rootless Network Driver - Network stack for rootless Docker. pasta (default): actively maintained, preserves the real client source IP on inbound connections, lower idle CPU; slirp4netns: legacy fallback, maintenance-only upstream. The matching rootlesskit port driver is selected automatically. On Debian, the installer also applies the local AppArmor override pasta needs (see scripts/docker/install/rootless/rootless_apparmor.sh) so this is a single-toggle switch. **ADVANCED** [pasta:Pasta (default, actively maintained)|slirp4netns:slirp4netns (legacy fallback)]