diff --git a/README.md b/README.md
index 215e2d6..cf6a1bb 100644
--- a/README.md
+++ b/README.md
@@ -165,9 +165,12 @@ Full key list in `internal/config/config.go`.
 > hardcoded in `config.toml`, either keep it (banger preserves the
 > directory when `ssh_key_path` points inside it) or unset the key
 > and banger will manage the new default for you. The first time the
-> daemon starts against the new default, guest VMs need a fresh
-> workspace sync (`banger vm stop && start`, or `--rm` flows are
-> unaffected) so their `authorized_keys` pick up the new fingerprint.
+> daemon starts against a new key, any already-running guest VMs
+> still carry the previous fingerprint in their `authorized_keys`.
+> Stop-and-start each VM (`banger vm stop <name> && banger vm start
+> <name>`, or `vm restart`) to let the start-path reprovision the
+> work disk with the new key. Fresh VMs and `--rm` flows are
+> unaffected.
 
 ### `vm_defaults` — sizing for new VMs