diff --git a/.env.example b/.env.example
index 1636813..7de0c53 100644
--- a/.env.example
+++ b/.env.example
@@ -32,11 +32,11 @@ SNAPSHOT_TTL_SECONDS=300
 # Continuous rolling sweep for open RTSP port 554 across a range. Runs on the
 # Pi host via deploy/osint-masscan.service (needs root + raw sockets). Results
 # land in the same `cameras` table as the scraper (discovery_source=masscan).
-# NOTE: at a conservative 10000 pps a full 0.0.0.0/0 sweep takes ~5 days, so
-# this is a continuous rolling sweep, not a daily job.
+# NOTE: 1000 pps is the residential-safe default. 10k pps saturated a home
+# uplink. A full 0.0.0.0/0 sweep at 1000 pps takes ~50 days (rolling).
 MASSCAN_RANGE=0.0.0.0/0
 MASSCAN_PORTS=554
-MASSCAN_RATE=10000
+MASSCAN_RATE=1000
 MASSCAN_RETRIES=1
 MASSCAN_WAIT=0
 MASSCAN_EXCLUDEFILE=/etc/osint-dashboard/masscan-excludes.txt
diff --git a/app/masscan_config.py b/app/masscan_config.py
index 81df645..f55c386 100644
--- a/app/masscan_config.py
+++ b/app/masscan_config.py
@@ -12,12 +12,13 @@ ETHICS / SCOPE (mirrors camera_scraper.py):
     scanner never probes RFC1918, loopback, link-local, multicast, or the
     bogons. Fail closed if the excludefile is missing.
 
-TIMING REALITY: at the default conservative rate of 10,000 pps a full IPv4
-sweep (0.0.0.0/0, ~4.29B addresses) takes ~119 hours (~5 days). This is
-therefore a CONTINUOUS ROLLING SWEEP, not a "finish in a day" job: masscan
-streams open hosts to stdout and the runner ingests them incrementally, then
+TIMING REALITY: at the residential-safe default of 1,000 pps a full IPv4
+sweep (0.0.0.0/0, ~4.29B addresses) takes ~50 days. This is therefore a
+CONTINUOUS ROLLING SWEEP, not a "finish in a day" job: masscan streams
+open hosts to stdout and the runner ingests them incrementally, then
 restarts the sweep when a pass completes. New cameras are detected as they
-appear on each pass.
+appear on each pass. 10k pps saturated a home uplink — do not raise the
+rate unless you are on a VPS / unmetered link.
 """
 
 from __future__ import annotations
@@ -33,9 +34,9 @@ MASSCAN_RANGE = os.getenv("MASSCAN_RANGE", "0.0.0.0/0")
 # Port(s) to probe. Default 554 = RTSP, the typical IP-camera port.
 MASSCAN_PORTS = os.getenv("MASSCAN_PORTS", "554")
 
-# Packets/sec. 10,000 = conservative, polite, residential-IP friendly
-# (~5 days for a full sweep). Raise carefully on a capable host/VPS.
-MASSCAN_RATE = int(os.getenv("MASSCAN_RATE", "10000"))
+# Packets/sec. 1,000 is the residential-safe default — 10k pps saturated
+# a home uplink. Raise only on a VPS / unmetered link.
+MASSCAN_RATE = int(os.getenv("MASSCAN_RATE", "1000"))
 
 # Retransmission count. 1 maximizes unique-host coverage at low rate; the
 # default (10) spends most of the budget re-probing the same hosts.
diff --git a/deploy/README.md b/deploy/README.md
index dbb5eae..cbe25b8 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -14,7 +14,7 @@
 #   cat > /etc/osint-dashboard/masscan.env <<'EOF'
 #   MASSCAN_RANGE=0.0.0.0/0
 #   MASSCAN_PORTS=554
-#   MASSCAN_RATE=10000
+#   MASSCAN_RATE=1000
 #   EOF
 #
 #   # Venv for the scanner (host-level, not the compose image):