diff --git a/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx b/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
index 1f88a5ea7fb29..3cf958de6fbe6 100644
--- a/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
+++ b/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx
@@ -1127,7 +1127,8 @@ For this reason, it is strongly discouraged to set a custom image when using
 automatic updates. Teleport Cloud uses automatic updates by default.
 </Admonition>
 
-Hardened distroless images are used by default.
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
 This setting only takes effect when [`enterprise`](#enterprise) is `false`.
 When running an enterprise version, you must use
 [`enterpriseImage`](#enterpriseImage) instead.
@@ -1153,7 +1154,8 @@ Teleport-published image.
   using automatic updates. Teleport Cloud uses automatic updates by default.
 </Admonition>
 
-Hardened distroless images are used by default.
+By default, the image contains only the Teleport application and its runtime
+dependencies, and does not contain a shell.
 This setting only takes effect when [`enterprise`](#enterprise) is `true`.
 When running an enterprise version, you must use [`image`](#image) instead.
 
diff --git a/examples/chart/teleport-cluster/values.yaml b/examples/chart/teleport-cluster/values.yaml
index 2596ddac913cd..6a11b492a9879 100644
--- a/examples/chart/teleport-cluster/values.yaml
+++ b/examples/chart/teleport-cluster/values.yaml
@@ -568,11 +568,13 @@ tls:
 # Values that you shouldn't need to change.
 ##################################################
 
-# Container image for the cluster.
-# Hardened distroless images are used by default.
+# Container image for the cluster. By default, the image contains only the
+# Teleport application and its runtime dependencies, and does not contain a
+# shell.
 image: public.ecr.aws/gravitational/teleport-distroless
-# Enterprise version of the image
-# Hardened distroless images are used by default.
+# Enterprise version of the image. By default, the image contains only the
+# Teleport application and its runtime dependencies, and does not contain a
+# shell.
 enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless
 # Optional array of imagePullSecrets, to use when pulling from a private registry
 imagePullSecrets: []
diff --git a/examples/chart/teleport-kube-agent/values.yaml b/examples/chart/teleport-kube-agent/values.yaml
index 70f4ffb81cb08..9b7783e022c11 100644
--- a/examples/chart/teleport-kube-agent/values.yaml
+++ b/examples/chart/teleport-kube-agent/values.yaml
@@ -891,7 +891,8 @@ adminClusterRoleBinding:
 # automatic updates. Teleport Cloud uses automatic updates by default.
 # </Admonition>
 #
-# Hardened distroless images are used by default.
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
 # This setting only takes effect when [`enterprise`](#enterprise) is `false`.
 # When running an enterprise version, you must use
 # [`enterpriseImage`](#enterpriseImage) instead.
@@ -912,7 +913,8 @@ image: public.ecr.aws/gravitational/teleport-distroless
 #   using automatic updates. Teleport Cloud uses automatic updates by default.
 # </Admonition>
 #
-# Hardened distroless images are used by default.
+# By default, the image contains only the Teleport application and its runtime
+# dependencies, and does not contain a shell.
 # This setting only takes effect when [`enterprise`](#enterprise) is `true`.
 # When running an enterprise version, you must use [`image`](#image) instead.
 enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless