diff --git a/docs/img/use-teleport/vnet-starting@2x.png b/docs/img/use-teleport/vnet-starting@2x.png
index 2d59067e99fe..67e321dfc6a1 100644
Binary files a/docs/img/use-teleport/vnet-starting@2x.png and b/docs/img/use-teleport/vnet-starting@2x.png differ
diff --git a/docs/pages/connect-your-client/vnet.mdx b/docs/pages/connect-your-client/vnet.mdx
index 5a6254e32861..f2ba50765502 100644
--- a/docs/pages/connect-your-client/vnet.mdx
+++ b/docs/pages/connect-your-client/vnet.mdx
@@ -32,9 +32,10 @@ have `tcp://` as the protocol in their addresses.
 Click "Connect" next to the TCP app. This starts VNet if it's not already running. Alternatively,
 you can start VNet through the connection list in the top left.
 
-VNet needs to set up a network device and configure DNS on your device, so it'll ask for admin
-permissions. For now your password is needed each time you start VNet, but we're working on showing
-the prompt only once.
+During the first launch, macOS will prompt you to enable a background item for tsh.app. VNet needs
+this background item in order to configure DNS on your device. To enable the background item, either
+interact with the system notification or go to System Settings > General > Logit Items and look for
+tsh.app under "Allow in the Background".
 
 ![VNet starting up](../../img/use-teleport/vnet-starting@2x.png)