diff --git a/.env.example b/.env.example
index be79efb..78b6720 100644
--- a/.env.example
+++ b/.env.example
@@ -117,9 +117,11 @@ IP_SCRUTINY_ABUSE_THRESHOLD=1
 IP_SCRUTINY_AUTO_IPBLOCK=true
 
 # Severity applied to auto-registered blocks: sign_up_requires_approval (soft,
-# recommended), sign_up_block (hard — no queue, cannot appeal via this bot),
-# or no_access (blocks all access, not just signups).
-IP_SCRUTINY_IPBLOCK_SEVERITY=sign_up_requires_approval
+# sends flagged range's future signups to the moderator queue), sign_up_block
+# (hard — flatly rejects future signups from the range at registration, no
+# queue, cannot appeal via this bot), or no_access (blocks all access, not
+# just signups).
+IP_SCRUTINY_IPBLOCK_SEVERITY=sign_up_block
 
 # check-mail.org disposable/high-risk email domain scrutiny (roadmap item B,
 # anti-abuse.md). Domain-only query (never the full email) against
diff --git a/README.md b/README.md
index 6da201a..90f958f 100644
--- a/README.md
+++ b/README.md
@@ -76,8 +76,10 @@ Every `account.created` delivery already carries the signup IP for free
      the signup IP belongs to (ipapi.is's `asn.route`, when it's a valid CIDR
      that actually contains the IP; otherwise just that one `/32`/`/128`) is
      added to Mastodon's native `Admin::IpBlock` at
-     `IP_SCRUTINY_IPBLOCK_SEVERITY` (default `sign_up_requires_approval`,
-     reversible from the admin UI). Blocking the whole network rather than
+     `IP_SCRUTINY_IPBLOCK_SEVERITY` (default `sign_up_block` — a hard reject
+     of future signups from the range at registration, no moderator queue,
+     no appeal via this bot; reversible from the admin UI). Blocking the
+     whole network rather than
      the single address matters here specifically because a flagged signup is
      almost always datacenter/VPN/proxy space — a repeat bad actor is far more
      likely to come back from a different address in the same block than the
@@ -218,7 +220,7 @@ Copy `.env.example` to `.env` and fill in:
 | `IP_SCRUTINY_HOLD_WELCOME` | `true` — hold the welcome for a flagged signup until `account.approved` |
 | `IP_SCRUTINY_ABUSE_THRESHOLD` | Distinct-reporter threshold used (if lower) for accounts with a flagged signup IP |
 | `IP_SCRUTINY_AUTO_IPBLOCK` | Auto-register a flagged signup's network (ipapi.is route, or its own `/32`/`/128` if no route) into Mastodon's `Admin::IpBlock` |
-| `IP_SCRUTINY_IPBLOCK_SEVERITY` | `sign_up_requires_approval` (default), `sign_up_block`, or `no_access` |
+| `IP_SCRUTINY_IPBLOCK_SEVERITY` | `sign_up_block` (default) — hard reject, no queue; other options: `sign_up_requires_approval` (soft, moderator queue), `no_access` |
 | `CHECK_MAIL_ENABLED` | Master switch for disposable/high-risk email signup scrutiny |
 | `CHECK_MAIL_API_KEY` | check-mail.org API key; blank disables the check |
 | `CHECK_MAIL_DRY_RUN` | `true` — classify + DM only, no held welcome, no email_domain_block write, no report-triggered suspend |