diff --git a/AGENTS.md b/AGENTS.md
index 7a50aa7..de610ea 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,9 @@
 # Agent guidelines for agent-sandbox
 
+## Deployed config
+
+`config-example.toml` in the repo root is the canonical config file. It is symlinked into `$XDG_CONFIG_HOME/agent-sandbox/config.toml` on the host. When editing it, remember that changes take effect immediately for all sandbox invocations.
+
 ## Build and test
 
 - `cargo fmt` and `cargo clippy` must pass before every commit.
diff --git a/README.md b/README.md
index 95a0323..b3aa868 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,11 @@ Both modes apply a seccomp-BPF syscall allowlist derived from Podman's default p
 
 ## Configuration file
 
-Settings can be stored in a TOML config file at `$XDG_CONFIG_HOME/agent-sandbox/config.toml` (or pass `--config <path>`). Use `--no-config` to skip loading it. The config file accepts the same options as the corresponding CLI flags.
+Settings can be stored in a TOML config file at `$XDG_CONFIG_HOME/agent-sandbox/config.toml` (or pass `--config <path>`). Use `--no-config` to skip loading it. The config file accepts the same options as the corresponding CLI flags. `config-example.toml` in the repo root is a fully commented example — symlink it into place to use it directly:
+
+```bash
+ln -sf "$(pwd)/config-example.toml" "${XDG_CONFIG_HOME:-$HOME/.config}/agent-sandbox/config.toml"
+```
 
 Top-level keys set defaults; `[profile.<name>]` sections define named presets selectable with `--profile <name>`. CLI flags always take highest precedence, followed by the active profile, then top-level defaults.