diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh
index 865a5e08..30340db5 100644
--- a/scripts/setup/machine-setup/lib/packages.sh
+++ b/scripts/setup/machine-setup/lib/packages.sh
@@ -53,11 +53,13 @@ LAST_SKIPPED=()
 #
 # Two entries reach beyond simply existing on the machine.
 #
-# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and
-# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log
-# in five times in ten minutes is blocked for ten. That is the point of it, and it
-# is worth having by default — but it is why it appears here rather than being
-# thought of as another binary. An existing install with its own jails is
+# fail2ban is not a tool, it is a daemon: installing it starts it, and Ubuntu
+# ships /etc/fail2ban/jail.d/defaults-debian.conf with `[sshd] enabled = true`.
+# Verified on this host — maxretry 5, findtime 600, bantime 600 — so from the
+# moment it installs, an address failing to log in five times in ten minutes is
+# blocked for ten, including yours. That is the point of it and it is worth
+# having by default, but it is why it belongs in this comment rather than being
+# thought of as one more binary. An existing install with its own jails is
 # untouched, because pkg_install never names a package that is already there.
 #
 # build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,