diff --git a/NEWS b/NEWS
index 1614fc4940..ccadaa256d 100644
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,12 @@ CHANGES WITH 262:
           allows a container to be started with systemd as PID1 without
           installing any unit files.
 
+        * RestrictFileSystemAccess= now permits execution from overlayfs
+          mounts whose file data resides on a signed and verified
+          dm-verity-protected filesystem, while still denying files in a
+          writable upper layer. This requires kernel v7.2 or newer; on older
+          kernels execution from overlayfs mounts remains denied entirely.
+
         Changes in systemd-firstboot:
 
         * The "systemd.firstboot=" kernel command line option now accepts the
diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index e33267409b..9f70dc0c3a 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -553,10 +553,12 @@
         shared libraries (<literal>mmap_file</literal>), and write-to-execute transitions such as JIT
         compilation (<literal>file_mprotect</literal>).</para>
 
-        <para>Note that execution from overlayfs mounts is blocked even if the underlying layers reside on
-        signed dm-verity devices, because the BPF program sees the overlay filesystem's anonymous device
-        number rather than the underlying block device. Multi-device filesystems such as btrfs are similarly
-        unsupported.</para>
+        <para>Since v262, files on overlayfs mounts are resolved to the layer that hosts their data, so
+        execution from an overlay whose data resides on a signed dm-verity device is permitted, while files
+        in a writable upper layer are denied. This requires kernel v7.2 or newer; on older kernels execution from
+        overlayfs mounts is denied entirely. Note that only the file data is checked, so an untrusted upper
+        layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
+        btrfs are unsupported.</para>
 
         <para>Note that, without further measures to secure the system, kexec can be used to circumvent this.</para>