diff --git a/gokrazy/README.md b/gokrazy/README.md
index af41ad62a..f41d43cbf 100644
--- a/gokrazy/README.md
+++ b/gokrazy/README.md
@@ -74,3 +74,30 @@ $ aws ec2-instance-connect send-serial-console-ssh-public-key --instance-id i-0b
 }
 $ ssh i-0b4a0eabc43629f13.port0@serial-console.ec2-instance-connect.us-west-2.aws 
 ```
+
+### Configuring the appliance
+
+The appliance's `tailscaled` runs with `-config=optional:vm:user-data`, so a
+single AMI supports two ways of joining a tailnet:
+
+- **Declarative (user-data):** put a Tailscale config (the `alpha0` HuJSON
+  format) in the instance's user-data and the node configures itself on first
+  boot. The minimal config is just an auth key:
+
+  ```json
+  {
+    "Version": "alpha0",
+    "AuthKey": "tskey-auth-..."
+  }
+  ```
+
+  A config present in user-data locks the CLI (`tailscale set`/`up` are
+  rejected) unless it sets `"Locked": false`.
+
+- **Interactive (serial console):** launch the AMI with *no* user-data. The
+  `optional:` prefix means the missing config is not an error, so `tailscaled`
+  boots unconfigured and you can enroll it over the serial console (connect as
+  above, then run `tailscale up` and open the printed login URL).
+
+To require config instead (fail to boot if none is present), build an image
+whose `tailscaled` uses `-config=vm:user-data` without the `optional:` prefix.
diff --git a/gokrazy/tsapp-vm.arm64/config.json b/gokrazy/tsapp-vm.arm64/config.json
index 42c38840c..94993729f 100644
--- a/gokrazy/tsapp-vm.arm64/config.json
+++ b/gokrazy/tsapp-vm.arm64/config.json
@@ -32,6 +32,9 @@
             ]
         },
         "tailscale.com/cmd/tailscaled": {
+            "CommandLineFlags": [
+                "-config=optional:vm:user-data"
+            ],
             "GoBuildTags": [
                 "ts_appliance"
             ]
diff --git a/gokrazy/tsapp/config.json b/gokrazy/tsapp/config.json
index c46dc6f1f..8094180fa 100644
--- a/gokrazy/tsapp/config.json
+++ b/gokrazy/tsapp/config.json
@@ -32,6 +32,9 @@
             ]
         },
         "tailscale.com/cmd/tailscaled": {
+            "CommandLineFlags": [
+                "-config=optional:vm:user-data"
+            ],
             "GoBuildTags": [
                 "ts_appliance"
             ]