diff --git a/README.md b/README.md
index 23fc0bb..398b97b 100644
--- a/README.md
+++ b/README.md
@@ -279,8 +279,12 @@ two tables below are split along exactly that line.
 | `nomarchy.services.restic.enable` | `false` | Opt-in: scheduled daily restic backup (set `.repository` + `.passwordFile`; backs up `.paths`, default `/home`; 7/4/6 retention; list/restore via the `restic-nomarchy` wrapper) |
 
 Beyond the `nomarchy.*` surface, the system layer turns on the usual
-desktop services with `lib.mkDefault` (override natively). Two worth
-calling out: **`services.fwupd.enable`** is on by default for firmware
+desktop services with `lib.mkDefault` (override natively) and enforces
+baseline security/stability defaults. A few worth calling out:
+**`security.apparmor.enable`** is on by default for mandatory access
+control confinement. **Kernel panics** are configured to auto-reboot the
+machine after 10 seconds (`panic=10 oops=panic`) rather than hanging
+indefinitely. **`services.fwupd.enable`** is on by default for firmware
 updates via LVFS — it only refreshes metadata, never flashes on its own,
 so run `fwupdmgr update` to apply; disable with `services.fwupd.enable =
 false;` on machines without real firmware (VMs/headless). And