diff --git a/container/agent-runner/src/mcp-tools/cli.instructions.md b/container/agent-runner/src/mcp-tools/cli.instructions.md
index 63a8674..b6f3173 100644
--- a/container/agent-runner/src/mcp-tools/cli.instructions.md
+++ b/container/agent-runner/src/mcp-tools/cli.instructions.md
@@ -71,26 +71,9 @@ ncl groups config add-package --npm some-package
 ncl members add --user telegram:jane
 ```
 
-### Config changes require a restart
+### Important
 
-Changes made via `ncl groups config update` (model, provider, effort, etc.) are saved to the DB but do **not** take effect on the running container. You must restart for them to apply:
-
-```bash
-ncl groups config update --model claude-sonnet-4-5-20250514
-# After approval: config is saved but container still runs the old model
-ncl groups restart --message "Applying config update."
-# After approval: container restarts with the new config
-```
-
-Package and MCP server changes (`config add-package`, `config add-mcp-server`) also require a restart. For packages, use `--rebuild` since they're baked into the image:
-
-```bash
-ncl groups config add-package --npm some-package
-# After approval:
-ncl groups restart --rebuild --message "Installing new package."
-```
-
-Without `--message`, the container is killed but only comes back on the next user message.
+Config changes via `ncl groups config update` do not take effect until `ncl groups restart`. Run `ncl groups config help` for details.
 
 ### Tips
 
diff --git a/src/cli/resources/groups.ts b/src/cli/resources/groups.ts
index c6a19ec..848b35a 100644
--- a/src/cli/resources/groups.ts
+++ b/src/cli/resources/groups.ts
@@ -119,7 +119,8 @@ registerResource({
     'config update': {
       access: 'approval',
       description:
-        'Update container config scalar fields. Use --id <group-id> and any of: --provider, --model, --effort, --image-tag, --assistant-name, --max-messages-per-prompt, --cli-scope.',
+        'Update container config scalar fields. Changes are saved but do NOT take effect until you run `ncl groups restart`. ' +
+        'Use --id <group-id> and any of: --provider, --model, --effort, --image-tag, --assistant-name, --max-messages-per-prompt, --cli-scope.',
       handler: async (args) => {
         const id = args.id as string;
         if (!id) throw new Error('--id is required');
@@ -162,7 +163,8 @@ registerResource({
     'config add-mcp-server': {
       access: 'approval',
       description:
-        'Add an MCP server to a group. Use --id <group-id> --name <server-name> --command <cmd> [--args <json-array>] [--env <json-object>].',
+        'Add an MCP server to a group. Requires `ncl groups restart` to take effect. ' +
+        'Use --id <group-id> --name <server-name> --command <cmd> [--args <json-array>] [--env <json-object>].',
       handler: async (args) => {
         const id = args.id as string;
         if (!id) throw new Error('--id is required');
@@ -187,7 +189,8 @@ registerResource({
     },
     'config remove-mcp-server': {
       access: 'approval',
-      description: 'Remove an MCP server from a group. Use --id <group-id> --name <server-name>.',
+      description:
+        'Remove an MCP server from a group. Requires `ncl groups restart` to take effect. Use --id <group-id> --name <server-name>.',
       handler: async (args) => {
         const id = args.id as string;
         if (!id) throw new Error('--id is required');
@@ -207,7 +210,8 @@ registerResource({
     },
     'config add-package': {
       access: 'approval',
-      description: 'Add a package to a group. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
+      description:
+        'Add a package to a group. Requires `ncl groups restart --rebuild` to take effect. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
       handler: async (args) => {
         const id = args.id as string;
         if (!id) throw new Error('--id is required');
@@ -242,7 +246,8 @@ registerResource({
     },
     'config remove-package': {
       access: 'approval',
-      description: 'Remove a package from a group. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
+      description:
+        'Remove a package from a group. Requires `ncl groups restart --rebuild` to take effect. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
       handler: async (args) => {
         const id = args.id as string;
         if (!id) throw new Error('--id is required');