diff --git a/HACKING.md b/HACKING.md
index e0943f5e6..42f50fe64 100644
--- a/HACKING.md
+++ b/HACKING.md
@@ -28,8 +28,14 @@ mimick what is run on *osbuild-composer*'s continuous integration
 infrastructure, i.e., installing `osbuild-composer-tests` and starting the
 service.
 
-You can log into the running machine as user `admin`, with the
-password `foobar`. Stopping the machine loses all data.
+The virtual machine uses qemu's user mode networking [1], forwarding port 22 to
+the host's 2222 and 443 to 4430. You can log into the running machine with
+
+    ssh admin@localhost -p 2222
+
+The password is `foobar`. Stopping the machine loses all data.
 
 For a quick compile and debug cycle, we recommend iterating code using thorough
 unit tests before going through the full workflow described above.
+
+[1]: https://wiki.qemu.org/Documentation/Networking#User_Networking_.28SLIRP.29
diff --git a/tools/deploy/test/user-data.yml b/tools/deploy/test/user-data.yml
index 28c9c9398..a932cf87b 100644
--- a/tools/deploy/test/user-data.yml
+++ b/tools/deploy/test/user-data.yml
@@ -1,5 +1,9 @@
 #cloud-config
 yum_repos:
+  # Fetch osbuild packages from a repository served on the host.
+  #
+  # In qemu user networking, 10.0.2.2 always points to the host:
+  # https://wiki.qemu.org/Documentation/Networking#User_Networking_.28SLIRP.29
   osbuild:
     name: osbuild
     baseurl: "http://10.0.2.2:8000"