diff --git a/deploy/unraid/README.md b/deploy/unraid/README.md
index 29eba81e..3f6eedb0 100644
--- a/deploy/unraid/README.md
+++ b/deploy/unraid/README.md
@@ -87,16 +87,16 @@ the backend remain available to trusted in-container operator scripts.
 Production startup fails before replacing the active container when the
 password is empty or one of the documented defaults.
 
-Guest access is enabled by default when the operator login gate is active:
+Guest access is disabled by default and must be explicitly enabled only for a dedicated demo instance:
 
 ```env
-GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_ACCESS_ENABLED=false
 GEOINTEL_GUEST_DISPLAY_NAME=Gast
 GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
 ```
 
-No extra guest setting is required for a new authenticated deployment. Set
-`GEOINTEL_GUEST_ACCESS_ENABLED=false` to disable the button and guest endpoint.
+Set `GEOINTEL_GUEST_ACCESS_ENABLED=true` only on a dedicated demo deployment
+to enable the guest button and guest endpoint.
 This adds **Als gast verkennen** to the landing page. The generated guest cookie
 is short-lived, project-scoped and limited to the canonical demo workflow.
 Operator mutations and access to another project are rejected by the backend,