diff --git a/operator_setup.sh b/operator_setup.sh
index 6f621d9..38a8f84 100755
--- a/operator_setup.sh
+++ b/operator_setup.sh
@@ -317,7 +317,7 @@ echo "  [1] None"
 echo "  [2] Tailscale"
 echo "  [3] WireGuard"
 echo "  [4] Reverse SSH Tunnel (autossh) — no traffic until operator connects"
-prompt_default vpn_opt "Select VPN (1-4)" "1"
+prompt_default vpn_opt "Select VPN (1-4)" "2"
 
 BB_VPN="none"
 TAILSCALE_KEY=""
@@ -333,6 +333,7 @@ if [[ "$vpn_opt" == "1" ]]; then
     BB_VPN="none"
 elif [[ "$vpn_opt" == "2" ]]; then
     BB_VPN="tailscale"
+    echo -e "  ${YELLOW}Use a reusable, non-expiring key from Tailscale admin → Settings → Auth keys${NC}"
     prompt_default tailscale_key "Tailscale auth key" ""
     TAILSCALE_KEY="$tailscale_key"
 elif [[ "$vpn_opt" == "3" ]]; then