diff --git a/README.md b/README.md
index 5106f32..83fa05a 100644
--- a/README.md
+++ b/README.md
@@ -107,8 +107,8 @@ Networking:
 
 - Enable ARP filtering to mitigate some ARP spoofing and ARP cache poisoning attacks.
 
-- Optional - Respond to ARP requests only if the target IP address is
-  on-link, preventing some IP spoofing attacks.
+- Respond to ARP requests only if the target IP address is  on-link,
+  preventing some IP spoofing attacks.
 
 - Optional - Drop gratuitous ARP packets to prevent ARP cache poisoning
   via man-in-the-middle and denial-of-service attacks.
diff --git a/usr/lib/sysctl.d/990-security-misc.conf b/usr/lib/sysctl.d/990-security-misc.conf
index 47152d7..2ac9fca 100644
--- a/usr/lib/sysctl.d/990-security-misc.conf
+++ b/usr/lib/sysctl.d/990-security-misc.conf
@@ -470,7 +470,7 @@ net.ipv4.conf.*.arp_filter=1
 ## https://github.com/mullvad/mullvadvpn-app/pull/7141
 ## https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf
 ##
-#net.ipv4.conf.*.arp_ignore=2
+net.ipv4.conf.*.arp_ignore=2
 
 ## Drop gratuitous ARP (Address Resolution Protocol) packets.
 ## Stops ARP responses sent by a device without being explicitly requested.