diff --git a/templates/default.yaml b/templates/default.yaml
index b6d14b71..e93c07f0 100644
--- a/templates/default.yaml
+++ b/templates/default.yaml
@@ -394,7 +394,7 @@ user:
   # The shell must already exist in the guest image.
   # 🟢 Builtin default: "/bin/bash" (Linux), "/bin/zsh" (macOS), "/bin/sh" (FreeBSD), "cmd.exe" (Windows)
   shell: null
-  # EXPERIMENTAL
+  # Setting this to false is EXPERIMENTAL (the default true is not experimental).
   # If false, a secure 16-character random password will be generated inside
   # the guest on first boot and saved to `~/password` (with 0600 permissions).
   # The user should manually rotate this password after the initial login.
diff --git a/website/content/en/docs/config/sudo.md b/website/content/en/docs/config/sudo.md
index 12835638..407ca050 100644
--- a/website/content/en/docs/config/sudo.md
+++ b/website/content/en/docs/config/sudo.md
@@ -8,6 +8,10 @@ weight: 40
 
 By default, the guest user has passwordless sudo (`NOPASSWD:ALL`).
 
+> **Warning**
+> `user.passwordlessSudo: false` is [experimental]({{< ref "/docs/releases/experimental" >}}).
+> The default `user.passwordlessSudo: true` is not experimental.
+
 The password is only generated once, on first boot. If you manually change the
 password and remove `~/password`, it will **not** be regenerated on subsequent
 boots, the file is purely informational for the initial login.
diff --git a/website/content/en/docs/releases/experimental.md b/website/content/en/docs/releases/experimental.md
index a3851eba..5ca0b795 100644
--- a/website/content/en/docs/releases/experimental.md
+++ b/website/content/en/docs/releases/experimental.md
@@ -13,7 +13,7 @@ The following features are experimental and subject to change:
 - `audio.device`, `audio.interface`, and `audio.microphone`
 - `mountInotify: true`
 - `tpm: true`
-- `user.passwordlessSudo` (See [Sudo]({{< ref "/docs/config/sudo" >}}))
+- `user.passwordlessSudo: false` (See [Sudo]({{< ref "/docs/config/sudo" >}}))
 - `External drivers`: building and using drivers as separate executables (see [Virtual Machine Drivers]({{< ref "/docs/dev/drivers" >}}))
 - [`vmType: krunkit`]({{< ref "/docs/config/vmtype/krunkit" >}})
 - [`vmType:hcs`]({{< ref "/docs/config/vmtype/hcs" >}})