diff --git a/README.md b/README.md
index 644bfa4..88c2627 100644
--- a/README.md
+++ b/README.md
@@ -76,8 +76,8 @@ whose whole point is a narrow blast radius. Add Docker only once a job
 genuinely needs it, and rethink the isolation model then.
 
 - `--name <name>` — runner name (default: this host's hostname)
-- `--labels <csv>` — extra runner labels (default: `ci-runner`; GitHub adds
-  `self-hosted` itself)
+- `--labels <csv>` — runner labels, replacing the `ci-runner` default — keep
+  any label your workflows' `runs-on` needs (GitHub adds `self-hosted` itself)
 - `--user <name>` — the unprivileged service user (default: `github-runner`)
 
 **The registration token:** provide it via the `RUNNER_TOKEN` env var or type
diff --git a/commands/runner-install.sh b/commands/runner-install.sh
index 4756409..115e436 100755
--- a/commands/runner-install.sh
+++ b/commands/runner-install.sh
@@ -16,7 +16,7 @@ usage: rig runner install --repo <owner/repo> --version <pin> [options]
   --version <pin>       actions/runner release to install, e.g. 2.335.1
                         (required; no default — you state what you install)
   --name <name>         runner name (default: this host's hostname)
-  --labels <csv>        extra runner labels (default: ci-runner)
+  --labels <csv>        runner labels; replaces the default (default: ci-runner)
   --user <name>         unprivileged service user (default: github-runner;
                         created if absent; never root)