diff --git a/scripts/setup/machine-setup/lib/tailscale.sh b/scripts/setup/machine-setup/lib/tailscale.sh
index b8257534..0f5172b9 100644
--- a/scripts/setup/machine-setup/lib/tailscale.sh
+++ b/scripts/setup/machine-setup/lib/tailscale.sh
@@ -141,6 +141,15 @@ tailscale_networks_help() {
   echo "     internet in the first place. Installed at this point in the run,"
   echo "     before anything that can lock you out, so there is always a second"
   echo "     way in."
+  echo ""
+  echo "     Officer also administers it. Its Headscale app talks to headscale"
+  echo "     and offscale servers alike: register as many as you run, see which"
+  echo "     are actually up — each is probed, not remembered — and switch"
+  echo "     between them. On whichever is active you get the nodes, the users,"
+  echo "     the pre-auth keys, the invites and the ACL policy, with an"
+  echo "     assistant for writing it, plus a console and diagnostics. So the"
+  echo "     server this section sets up is managed from the same place as"
+  echo "     everything else on this machine, rather than over ssh and a CLI."
 }
 
 tailscale_is_installed() { command -v tailscale &>/dev/null; }