diff --git a/examples/deploy/nsjail-security-profiles/README.md b/examples/deploy/nsjail-security-profiles/README.md
index 1b2993d56f..a1ce8212c6 100644
--- a/examples/deploy/nsjail-security-profiles/README.md
+++ b/examples/deploy/nsjail-security-profiles/README.md
@@ -10,7 +10,7 @@ The two profiles here are the runtime defaults with only what nsjail needs added
 | File | Purpose |
 | --- | --- |
 | `windmill-nsjail.seccomp.json` | Docker's default seccomp profile plus `clone` with namespace flags, `mount`, `umount2`, `pivot_root` and `sethostname` |
-| `windmill-nsjail.apparmor` | The runtime default AppArmor profile with `deny mount` replaced by `mount`, `umount` and `pivot_root` rules |
+| `windmill-nsjail.apparmor` | The [runtime default AppArmor profile](https://github.com/moby/profiles/blob/main/apparmor/template.go) with `deny mount` replaced by `mount`, `umount` and `pivot_root` rules; every other rule, including the denied socket families, is kept |
 | `kubernetes-user-namespaces.yaml` | Worker pod settings with no added capability (`hostUsers: false`, `procMount: Unmasked`) |
 | `kubernetes-sys-admin.yaml` | Worker pod settings for clusters without user namespaces (`SYS_ADMIN`) |
 | `generate-seccomp.py` | Rebuilds the seccomp profile from a newer Docker default |
@@ -28,8 +28,6 @@ sudo install -m 0644 windmill-nsjail.apparmor /etc/apparmor.d/windmill-nsjail
 sudo apparmor_parser -r /etc/apparmor.d/windmill-nsjail
 ```
 
-If the node's audit log shows AppArmor denying `userns_create` for the worker, uncomment the `userns,` rule in the profile (it needs AppArmor 4.0 or later, older parsers reject it) and reload it.
-
 A pod that references a profile missing from its node fails to start, so node groups that autoscale need these steps in their bootstrap or in a DaemonSet. On nodes without AppArmor, remove the `appArmorProfile` block from the pod settings.
 
 ## Using the profiles with Docker
diff --git a/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor b/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor
index 97ff10b02f..82d936d340 100644
--- a/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor
+++ b/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor
@@ -1,12 +1,30 @@
-#include <tunables/global>
-
 # The container runtimes' default profile (docker-default,
 # cri-containerd.apparmor.d) with its blanket "deny mount" replaced by the
 # mount, umount and pivot_root rules nsjail needs to build a job's filesystem.
+#
+# The ABI is pinned to 3.0 as in the runtime default: from ABI 4.0, "network"
+# stops covering unix sockets and user namespace creation becomes mediated.
+abi <abi/3.0>,
+
+#include <tunables/global>
+
 profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
   network,
+  deny network ax25,
+  deny network ipx,
+  deny network appletalk,
+  deny network netrom,
+  deny network rose,
+  deny network econet,
+  deny network atmsvc,
+  deny network irda,
+  deny network wanpipe,
+  deny network isdn,
+  deny network caif,
+  deny network alg,
+  deny network vsock,
   capability,
   file,
 
@@ -14,10 +32,6 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
   umount,
   pivot_root,
 
-  # Needed where AppArmor mediates user namespace creation for this profile.
-  # AppArmor parsers older than 4.0 reject the rule, hence commented out.
-  # userns,
-
   signal (receive) peer=unconfined,
   signal (receive) peer=runc,
   signal (receive) peer=crun,
@@ -25,7 +39,7 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) {
   signal (send,receive) peer=windmill-nsjail,
 
   deny @{PROC}/* w,
-  deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w,
+  deny @{PROC}/{[^1-9/],[^1-9/][^0-9/],[^1-9s/][^0-9y/][^0-9s/],[^1-9/][^0-9/][^0-9/][^0-9/]*}/** w,
   deny @{PROC}/sys/[^k]** w,
   deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,
   deny @{PROC}/sysrq-trigger rwklx,