diff --git a/man/journald.conf.xml b/man/journald.conf.xml
index 30132bcffc..1a68ba8698 100644
--- a/man/journald.conf.xml
+++ b/man/journald.conf.xml
@@ -482,7 +482,7 @@
         kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor
         disable it, leaving the previous state unchanged.  This means if another tool turns on auditing even
         if <command>systemd-journald</command> left it off, it will still collect the generated
-        messages. Defaults to on.</para>
+        messages. Defaults to on in the default journal namespace, and unset otherwise.</para>
 
         <para>Note that this option does not control whether <command>systemd-journald</command> collects
         generated audit records, it just controls whether it tells the kernel to generate them. If you need
diff --git a/src/journal/journald-config.c b/src/journal/journald-config.c
index 58d86b507b..c266833b03 100644
--- a/src/journal/journald-config.c
+++ b/src/journal/journald-config.c
@@ -49,7 +49,9 @@ static void manager_set_defaults(Manager *m) {
         /* By default, only read from /dev/kmsg if are the main namespace */
         m->read_kmsg = !m->namespace;
 
-        m->set_audit = true;
+        /* By default, kernel auditing is enabled by the main namespace instance, and not controlled by
+         * non-default namespace instances. */
+        m->set_audit = m->namespace ? -1 : true;
 
         m->sync_interval_usec = DEFAULT_SYNC_INTERVAL_USEC;