diff --git a/docs/src/main/paradox/remote-security.md b/docs/src/main/paradox/remote-security.md
index 7e718c67a1..04fe82e80b 100644
--- a/docs/src/main/paradox/remote-security.md
+++ b/docs/src/main/paradox/remote-security.md
@@ -126,8 +126,15 @@ section.
 
 @@@ note
 
-When using SHA1PRNG on Linux it's recommended to specify `-Djava.security.egd=file:/dev/urandom` as argument
-to the JVM to prevent blocking. It is NOT as secure because it reuses the seed.
+`random-number-generator` defaults to the platform `SecureRandom`, which is the recommended
+setting. `SHA1PRNG` is a legacy algorithm: it draws a single seed at startup and never reseeds,
+where the platform default mixes fresh kernel randomness into every request.
+
+On Linux the seed comes from `securerandom.source` (`file:/dev/random` by default), overridable
+with `-Djava.security.egd`. On older kernels `/dev/random` could block on hosts with little
+entropy, which is the origin of the frequently suggested
+`-Djava.security.egd=file:/dev/urandom`; current kernels do not block once the pool is seeded
+at boot.
 
 @@@
 
diff --git a/docs/src/main/paradox/remoting.md b/docs/src/main/paradox/remoting.md
index 09f5c95c3c..af952ce51e 100644
--- a/docs/src/main/paradox/remoting.md
+++ b/docs/src/main/paradox/remoting.md
@@ -510,8 +510,15 @@ See also a description of the settings in the @ref:[Remote Configuration](remoti
 
 @@@ note
 
-When using SHA1PRNG on Linux it's recommended specify `-Djava.security.egd=file:/dev/urandom` as argument
-to the JVM to prevent blocking. It is NOT as secure because it reuses the seed.
+`random-number-generator` defaults to the platform `SecureRandom`, which is the recommended
+setting. `SHA1PRNG` is a legacy algorithm: it draws a single seed at startup and never reseeds,
+where the platform default mixes fresh kernel randomness into every request.
+
+On Linux the seed comes from `securerandom.source` (`file:/dev/random` by default), overridable
+with `-Djava.security.egd`. On older kernels `/dev/random` could block on hosts with little
+entropy, which is the origin of the frequently suggested
+`-Djava.security.egd=file:/dev/urandom`; current kernels do not block once the pool is seeded
+at boot.
 
 @@@
 
diff --git a/remote/src/main/resources/reference.conf b/remote/src/main/resources/reference.conf
index 5f32f714b7..dff6972bc2 100644
--- a/remote/src/main/resources/reference.conf
+++ b/remote/src/main/resources/reference.conf
@@ -725,7 +725,8 @@ pekko {
 
           # There are two options, and the default SecureRandom is recommended:
           # "" or "SecureRandom" => (default)
-          # "SHA1PRNG" => Can be slow because of blocking issues on Linux
+          # "SHA1PRNG" => Legacy algorithm, seeded once at startup and never
+          #               reseeded. The default is preferred.
           #
           # Setting a value here may require you to supply the appropriate cipher
           # suite (see enabled-algorithms section above)
@@ -1233,7 +1234,8 @@ pekko {
 
           # There are two options, and the default SecureRandom is recommended:
           # "" or "SecureRandom" => (default)
-          # "SHA1PRNG" => Can be slow because of blocking issues on Linux
+          # "SHA1PRNG" => Legacy algorithm, seeded once at startup and never
+          #               reseeded. The default is preferred.
           #
           # Setting a value here may require you to supply the appropriate cipher
           # suite (see enabled-algorithms section above)
@@ -1290,7 +1292,8 @@ pekko {
 
           # There are two options, and the default SecureRandom is recommended:
           # "" or "SecureRandom" => (default)
-          # "SHA1PRNG" => Can be slow because of blocking issues on Linux
+          # "SHA1PRNG" => Legacy algorithm, seeded once at startup and never
+          #               reseeded. The default is preferred.
           #
           # Setting a value here may require you to supply the appropriate cipher
           # suite (see enabled-algorithms section)