diff --git a/packaging/actions.conf.example b/packaging/actions.conf.example
index bfb6ff9..da6ce1d 100644
--- a/packaging/actions.conf.example
+++ b/packaging/actions.conf.example
@@ -1,19 +1,14 @@
-# fingerprintd — per-finger actions.
+# fingerprintd per-finger actions.
 #
 # Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
 # exactly what it always did: it unlocks.
 #
-# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
-# announced on the system bus, unconditionally and with nothing configured:
+# This file is for running root scripts on finger actions.
+# For scripts that run in your session, you can use this D-Bus:
 #
 #     net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
 #     on /net/reactivated/Fprint/Device/0
 #
-# That is how a finger launches an application. An agent in your own session
-# hears the signal and decides what the finger means, from your own
-# configuration, running as you with your bus and your display. The daemon is
-# root and deliberately does not try to do that for you.
-#
 # This file is for the two things that do need the daemon.
 #
 # THIS FILE IS A ROOT SHELL. Every command here is run by root when that
@@ -38,30 +33,18 @@
 #   no-unlock  this finger never unlocks. The client is told it did not match,
 #              whatever really happened.
 #
-#   command    an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
-#              plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
-#              daemon and can never delay an unlock.
+#   command    an absolute path, passed to /bin/sh -c with a fixed environment
+#              plus FINGERPRINTD_FINGER.
 #
-# At least one of the two is required. A finger listed on its own says nothing
-# the signal above does not already say.
-
 # --- A finger that also does something, as root -----------------------------
 #right-ring-finger    /usr/local/bin/toggle-something
-
-# --- A finger that does not unlock ------------------------------------------
-#left-thumb           no-unlock
-
+#
 # --- A duress finger: rejected, and the script runs anyway ------------------
 #
-# Think carefully before making that script destructive:
-#
-#   * a false accept that opens a camera is a shrug; one that wipes is not,
-#   * and anyone who can compel one unlock can usually compel a second.
-#
-# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
-# rejection it fabricates is far faster than a real one — a finger the sensor
+# Know what this is not: It is a panic button, not deniability. The
+# rejection it fabricates is far faster than a real one. A finger the sensor
 # genuinely does not know takes about three seconds to be refused, this takes
-# milliseconds — the daemon's journal records that the finger really matched,
+# milliseconds. The daemon's journal records that the finger really matched,
 # this file names it in plain text, and the finger still shows as enrolled in
 # fprintd-list. It reliably runs your script. It does not reliably hide that
 # it did.