diff --git a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
index 2717c7e..a211b72 100755
--- a/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
+++ b/files/dracut/95dot1x-macsec/dot1x-macsec-up.sh
@@ -30,8 +30,8 @@ info "dot1x-macsec: using interface $NIC, NV index $NVINDEX"
 # The physical NIC is brought up with DHCP directly and dracut's cmdline-driven
 # nvmf module connects the root namespace over it — there is no macsec0, no
 # supplicant, no TPM cert read. The rest of the boot (rd.nvmf.discover, verity,
-# rootovl) is unchanged because it is driven by the kernel cmdline, not by this
-# hook. SECURITY: no link authentication or encryption in this mode — lab/test
+# systemd.volatile=overlay) is unchanged because it is driven by the kernel
+# cmdline, not by this hook. SECURITY: no link auth or encryption in this mode — lab/test
 # networks only. Remove rd.dot1x=0 from the cmdline to restore full security.
 if [ "$(getarg rd.dot1x=)" = "0" ]; then
     warn "dot1x-macsec: 802.1X/MACsec DISABLED (rd.dot1x=0) — TEST MODE, no link security"