diff --git a/scripts/setup/machine-setup/lib/tailscale.sh b/scripts/setup/machine-setup/lib/tailscale.sh
index 39b7f498..c1861271 100644
--- a/scripts/setup/machine-setup/lib/tailscale.sh
+++ b/scripts/setup/machine-setup/lib/tailscale.sh
@@ -67,10 +67,12 @@ tailscale_network_menu() {
   echo "         neither — it runs headscale's open-source code. What changes is"
   echo "         the work: managed from an app rather than a terminal, and"
   echo "         enrolling a device is a link and a tap."
-  echo "         It runs somewhere publicly reachable — a small VPS — not on this"
-  echo "         machine and not at home. Every device has to be able to find it,"
-  echo "         including the ones that are not on your network, so it needs an"
-  echo "         address that resolves from anywhere."
+  echo "         offscale — just like headscale, and just like Tailscale's own"
+  echo "         service — needs to run on a publicly reachable server of its"
+  echo "         own. A small VPS is enough. Not this machine, not behind a home"
+  echo "         router: every device that joins has to find it, including phones"
+  echo "         on mobile data. The only difference from option 3 is who runs"
+  echo "         that server."
   echo "         Follow that setup through first, then come back here with its"
   echo "         address and a key."
   echo "         https://officer.dev/infrastructure/offscale.html#install"
@@ -136,12 +138,17 @@ tailscale_networks_help() {
   # Where it runs matters more than how it installs, and is the thing people
   # get wrong: a coordination server at home is unreachable from exactly the
   # devices a private network exists to reach.
-  echo "     Where it runs: somewhere publicly reachable, on its own — a small"
+  echo "     Where it runs: on a publicly reachable server of its own — a small"
   echo "     VPS is enough. Not on this machine, and not behind a home router."
   echo "     Every device that joins has to find it, including phones on mobile"
   echo "     data and laptops in other buildings, so it needs an address that"
-  echo "     resolves from anywhere. That is true of headscale too; it is a"
-  echo "     property of being the thing everyone checks in with."
+  echo "     resolves from anywhere."
+  echo ""
+  echo "     This is not something offscale asks for and the others do not. It"
+  echo "     is true of headscale, and it is true of Tailscale — their"
+  echo "     coordination server is publicly reachable too, they simply run it"
+  echo "     for you. That is the whole of the difference between choosing"
+  echo "     option 3 and choosing to host it yourself."
   echo ""
   echo "     What it does that plain headscale does not:"
   echo "       · installs in one command on that server, certificates included"
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index ad531621..cc286400 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -457,9 +457,10 @@ if ! skip; then
             # what to say, not what to do.
             if [[ "$TS_PLANE_CHOICE" == "1" ]]; then
               echo ""
-              echo "     offscale runs on a publicly reachable server of its own — not"
-              echo "     this machine, and not behind a home router. Work through the"
-              echo "     whole setup there first:"
+              echo "     offscale — just like headscale, and just like Tailscale's own"
+              echo "     service — needs to run on a publicly reachable server of its"
+              echo "     own. Not this machine, and not behind a home router. Work"
+              echo "     through the whole setup there first:"
               echo ""
               echo "       https://officer.dev/infrastructure/offscale.html#install"
               echo ""