diff --git a/src/macros/config.rs b/src/macros/config.rs
index 8fc1f319..be2e43c4 100644
--- a/src/macros/config.rs
+++ b/src/macros/config.rs
@@ -73,8 +73,8 @@ fn generate_example(input: &ItemStruct, args: &[Meta], write: bool) -> Result<To
 				.expect("written to config file");
 		}
 
-		let pound = if section != "global" { "#" } else { "" };
-		file.write_fmt(format_args!("\n{pound}[{section}]\n"))
+		let pound = if section != "global" { "\n#" } else { "" };
+		file.write_fmt(format_args!("\n\n{pound}[{section}]\n"))
 			.expect("written to config file");
 	}
 
diff --git a/tuwunel-example.toml b/tuwunel-example.toml
index 5a41aef9..d974d477 100644
--- a/tuwunel-example.toml
+++ b/tuwunel-example.toml
@@ -15,6 +15,7 @@
 ### For more information, see:
 ### https://tuwunel.chat/configuration.html
 
+
 [global]
 
 # The server_name is the pretty name of this server. It is used as a
@@ -1833,6 +1834,8 @@
 #
 #one_time_key_limit = 256
 
+
+
 #[global.tls]
 
 # Path to a valid TLS certificate file.
@@ -1851,6 +1854,8 @@
 #
 #dual_protocol = false
 
+
+
 #[global.well_known]
 
 # The server URL that the client well-known file will serve. This should
@@ -1913,6 +1918,8 @@
 #
 #rtc_transports = []
 
+
+
 #[global.blurhashing]
 
 # blurhashing x component, 4 is recommended by https://blurha.sh/
@@ -1931,6 +1938,8 @@
 #
 #blurhash_max_raw_size = 33554432
 
+
+
 #[global.ldap]
 
 # Whether to enable LDAP login.
@@ -2018,6 +2027,8 @@
 #
 #admin_filter =
 
+
+
 #[global.jwt]
 
 # Enable JWT logins
@@ -2084,6 +2095,8 @@
 #
 #validate_signature = true
 
+
+
 #[global.appservice.<ID>]
 
 # The URL for the application service.
@@ -2126,6 +2139,8 @@
 #
 #device_management = false
 
+
+
 #[[global.appservice.<ID>.<users|rooms|aliases>]]
 
 # Whether this application service has exclusive access to events within