diff --git a/docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx b/docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx
index a59a02988f..42d128a262 100644
--- a/docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx
+++ b/docs/serverless/edr-install-config/configure-endpoint-integration-policy.mdx
@@ -249,7 +249,9 @@ register ((elastic-sec)) as your hosts' antivirus software by enabling **Registe
Windows Server is not supported. Antivirus registration requires Windows Security Center, which is not included in Windows Server operating systems.
-You can also choose **Sync with malware protection level** to automatically set antivirus registration based on how you've configured ((elastic-defend))'s malware protection. If malware protection is turned on and set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+By default, the **Sync with malware protection level** is selected to automatically set antivirus registration to match how you've configured ((elastic-defend))'s malware protection. If malware protection is turned on _and_ set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+
+If you don't want to sync antivirus registration, you can set it manually with the **Enabled** or **Disabled** option.
diff --git a/docs/serverless/images/configure-endpoint-integration-policy/-getting-started-register-as-antivirus.png b/docs/serverless/images/configure-endpoint-integration-policy/-getting-started-register-as-antivirus.png
index 25a12eea74..61fb3d2fa6 100644
Binary files a/docs/serverless/images/configure-endpoint-integration-policy/-getting-started-register-as-antivirus.png and b/docs/serverless/images/configure-endpoint-integration-policy/-getting-started-register-as-antivirus.png differ