diff --git a/README.md b/README.md
index 07c9bfa..5e9f1e9 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,7 @@ Host bind mounts (`--bind`, `--bind-rw`) are not applied in this mode.
 Requirements:
 - `qemu-system-<arch>` installed
 - For custom kernels: kernel must have serial console support
+- riscv64 VMs need QEMU ≥ 10.1 (`rva23s64` CPU, required by Ubuntu 25.10+ RVA23 userland)
 
 ## Supported distributions
 
diff --git a/SPEC.md b/SPEC.md
index 6bb2988..b4c373c 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -282,6 +282,7 @@ ecr --kernel=/boot/vmlinuz debian -- /bin/sh -c "echo hello"
    - `-display none -serial mon:stdio` - console on stdio
    - `-netdev user,id=net0 -device virtio-net-pci,netdev=net0` - network NIC
    - `-enable-kvm -cpu host` - when the host supports KVM and the target matches the host architecture
+   - `-cpu rva23s64` - riscv64 under TCG otherwise. Ubuntu builds its riscv64 port against the RVA23 profile (since 25.10); QEMU's default `rv64` CPU does not implement all profile extensions, so Ubuntu binaries die with SIGILL during init. Profiles are supersets, so baseline rv64gc rootfses (Alpine, older Ubuntu) run unchanged. Needs QEMU ≥ 10.1 (named profile CPUs).
 5. Wait for QEMU to exit (init powers the VM off when the command/shell exits; `-no-reboot` makes QEMU terminate)
 6. Cleanup temporary files