diff --git a/NEWS b/NEWS
index c34c55603e..c717a355ec 100644
--- a/NEWS
+++ b/NEWS
@@ -13,13 +13,13 @@ CHANGES WITH 261 in spe:
           attestation environments which use hardware CC registers and not the
           TPM quote.
 
-        * By default networking to cloud IMDS services is now locked down, for
-          recognized clouds. This is recommended for secure installations, but
-          typically conflicts with traditional IMDS clients such as cloud-init,
-          which require direct IMDS access currently. The new meson option
-          "imds-network" can be used to change the default networking mode to
-          "unlocked" at build-time, for compatibility. This is probably what
-          general purpose distributions should set for now.
+        New features:
+
+        * Networking to cloud IMDS services may be locked down for recognized
+          clouds. This is recommended for secure installations, but typically
+          conflicts with traditional IMDS clients such as cloud-init, which
+          require direct IMDS access. The new meson option "-Dimds-network="
+          can be used to change the default mode to "locked" at build-time.
 
 CHANGES WITH 260:
 
diff --git a/meson.build b/meson.build
index 36025023db..d820be416c 100644
--- a/meson.build
+++ b/meson.build
@@ -1544,7 +1544,7 @@ have = get_option('imds').require(
         conf.get('HAVE_LIBCURL') == 1,
         error_message : 'curl required').allowed()
 conf.set10('ENABLE_IMDS', have)
-conf.set10('IMDS_NETWORK_LOCKED_DEFAULT', get_option('imds-network') == 'locked')
+conf.set('IMDS_NETWORK_DEFAULT', 'IMDS_NETWORK_@0@'.format(get_option('imds-network')).to_upper())
 
 have = get_option('importd').require(
         conf.get('HAVE_LIBCURL') == 1 and
diff --git a/meson_options.txt b/meson_options.txt
index 30c5fd3ab6..d61afac519 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -144,7 +144,7 @@ option('timesyncd', type : 'boolean',
        description : 'install the systemd-timesyncd daemon')
 option('imds', type : 'feature',
        description : 'install the systemd-imds stack')
-option('imds-network', type : 'combo', choices : [ 'locked', 'unlocked' ],
+option('imds-network', type : 'combo', choices : ['unlocked', 'locked'],
        description : 'whether to default to locked/unlocked IMDS network mode')
 option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'],
        description : 'default storage mode for journald (main namespace)')
diff --git a/src/imds/imds-generator.c b/src/imds/imds-generator.c
index 9cb48688a8..42399783fa 100644
--- a/src/imds/imds-generator.c
+++ b/src/imds/imds-generator.c
@@ -15,8 +15,7 @@
 
 static int arg_enabled = -1;           /* Whether we shall offer local IMDS APIs */
 static bool arg_import = true;         /* Whether we shall import IMDS credentials, SSH keys, … into the local system */
-static ImdsNetworkMode arg_network_mode =
-        IMDS_NETWORK_LOCKED_DEFAULT ? IMDS_NETWORK_LOCKED : IMDS_NETWORK_UNLOCKED;
+static ImdsNetworkMode arg_network_mode = IMDS_NETWORK_DEFAULT;
 
 static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
         int r;