diff --git a/deploy/unraid/geointel.env.example b/deploy/unraid/geointel.env.example
index f9867917..3a2a5b38 100644
--- a/deploy/unraid/geointel.env.example
+++ b/deploy/unraid/geointel.env.example
@@ -46,12 +46,12 @@ GEOINTEL_AUTH_PASSWORD_HASH=
 GEOINTEL_AUTH_SESSION_SECRET=
 GEOINTEL_AUTH_SESSION_TTL_SECONDS=43200
 
-# Guest access is enabled by default whenever operator authentication is active.
-# It opens the seeded GeoIntel demo in a temporary, API-enforced restricted
-# session. Set this to false on installations containing private project data.
-# LET OP: scripts/configure_operator_login.sh zet dit op false tenzij je
-# expliciet --guest-access true meegeeft.
-GEOINTEL_GUEST_ACCESS_ENABLED=true
+# Guest access is demo-only and disabled by default. Enable it only on a
+# dedicated demo instance with a separate database/storage root and no private,
+# customer or operational data. It is not tenant isolation.
+# scripts/configure_operator_login.sh keeps it disabled unless
+# --guest-access true is supplied explicitly.
+GEOINTEL_GUEST_ACCESS_ENABLED=false
 GEOINTEL_GUEST_DISPLAY_NAME=Gast
 GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200