diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index a829963d..92f968d8 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -2157,6 +2157,8 @@ pub struct LdapConfig {
 	/// Root of the searches.
 	///
 	/// example: "ou=users,dc=example,dc=org"
+	///
+	/// default:
 	#[serde(default)]
 	pub base_dn: String,
 
@@ -2170,6 +2172,8 @@ pub struct LdapConfig {
 	///
 	/// example: "cn=ldap-reader,dc=example,dc=org" or
 	/// "cn={username},ou=users,dc=example,dc=org"
+	///
+	/// default: ""
 	#[serde(default)]
 	pub bind_dn: Option<String>,
 
@@ -2177,6 +2181,8 @@ pub struct LdapConfig {
 	/// `bind_dn`.
 	///
 	/// The server must be able to access the file, and it must not be empty.
+	///
+	/// default: ""
 	#[serde(default)]
 	pub bind_password_file: Option<PathBuf>,
 
@@ -2220,6 +2226,8 @@ pub struct LdapConfig {
 	/// Defaults to `base_dn` if empty.
 	///
 	/// example: "ou=admins,dc=example,dc=org"
+	///
+	/// default:
 	#[serde(default)]
 	pub admin_base_dn: String,
 
@@ -2232,6 +2240,8 @@ pub struct LdapConfig {
 	/// entered username for more complex filters.
 	///
 	/// example: "(objectClass=tuwunelAdmin)" or "(uid={username})"
+	///
+	/// default:
 	#[serde(default)]
 	pub admin_filter: String,
 }
diff --git a/tuwunel-example.toml b/tuwunel-example.toml
index 1a0493ae..4a1cabf0 100644
--- a/tuwunel-example.toml
+++ b/tuwunel-example.toml
@@ -1841,7 +1841,7 @@
 #
 # example: "ou=users,dc=example,dc=org"
 #
-#base_dn = false
+#base_dn =
 
 # Bind DN if anonymous search is not enabled.
 #
@@ -1854,14 +1854,14 @@
 # example: "cn=ldap-reader,dc=example,dc=org" or
 # "cn={username},ou=users,dc=example,dc=org"
 #
-#bind_dn = false
+#bind_dn = ""
 
 # Path to a file on the system that contains the password for the
 # `bind_dn`.
 #
 # The server must be able to access the file, and it must not be empty.
 #
-#bind_password_file = false
+#bind_password_file = ""
 
 # Search filter to limit user searches.
 #
@@ -1896,7 +1896,7 @@
 #
 # example: "ou=admins,dc=example,dc=org"
 #
-#admin_base_dn = false
+#admin_base_dn =
 
 # The LDAP search filter to find administrative users for tuwunel.
 #
@@ -1908,7 +1908,7 @@
 #
 # example: "(objectClass=tuwunelAdmin)" or "(uid={username})"
 #
-#admin_filter = false
+#admin_filter =
 
 #[global.jwt]