diff --git a/README.md b/README.md
index b00f43d..f26f54f 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ yet another coding agent harness, lightweight and written (vibe-slopped) in go.
 - four tools (read, write, edit, bash).
 - three run modes (interactive tui, print, json).
 - built-in telegram bot.
-- extensions in any language via subprocess + json-rpc; see [docs/extensions.md](docs/extensions.md).
+- extensions in any language via subprocess + json-rpc — none installed by default; opt in with `zot ext install` or `zot --ext`. see [docs/extensions.md](docs/extensions.md).
 - reusable instructions via `SKILL.md` files; see [docs/skills.md](docs/skills.md).
 - no community atm.
 
diff --git a/docs/extensions.md b/docs/extensions.md
index 1cd4e4f..e53bf9c 100644
--- a/docs/extensions.md
+++ b/docs/extensions.md
@@ -61,6 +61,25 @@ zot ext install ./hello-py
 
 Restart `zot`, type `/hellopy`, the agent greets you. Done.
 
+## Built-in extensions
+
+**zot ships with no extensions installed by default.** A fresh `zot install` (or `go install`) gives you a clean agent. Extensions are entirely opt-in: you install (or `--ext` for one run) only the ones you want.
+
+The `examples/extensions/` directory in the repo is reference code, not a default install set. To use any of those:
+
+```bash
+# go-based examples need a build first
+cd path/to/zot/examples/extensions/hello && go build -o hello .
+
+# install (copies to $ZOT_HOME/extensions/hello/)
+zot ext install path/to/zot/examples/extensions/hello
+
+# or load straight from the repo for one zot session
+zot --ext path/to/zot/examples/extensions/hello
+```
+
+Nothing is auto-installed and nothing reaches out to the network without your explicit action.
+
 ## Layout & discovery
 
 zot scans two directories on startup, in this order: