diff --git a/vmbox/README.md b/vmbox/README.md
index 93b6192..f7ef6f4 100644
--- a/vmbox/README.md
+++ b/vmbox/README.md
@@ -111,6 +111,14 @@ Two things that installer taught us, both worth knowing before you run it:
 - **No root anywhere.** User-mode networking with a per-VM forwarded SSH port;
   VM-to-VM traffic rides a socket multicast segment. No bridge, no libvirt, no
   daemon.
+- **User-mode networking stalls concurrent TCP streams.** Measured 2026-09-14
+  (libslirp 4.9.4, qemu 11.1.1): 5 parallel 60 MB downloads, 2–4 freeze at
+  ~10 MB and time out; one stream does 45 MB/s. The image therefore ships
+  `ParallelDownloads = 1` in pacman.conf — a 90-package `-Syu` that "ran at
+  500 KB/s" for minutes finished in 12 s single-stream. Guest-side TCP knobs
+  (window scaling, rmem) do not help; the real fix would be a tap/bridge NIC,
+  which needs root and is out of scope by design. Rebuild the base (`vm build`)
+  to pick this up; an already-built image lacks it.
 - **The guest clock is pinned** (`--rtc`) and re-applied on *every* launch. The
   shutdown installers gate on a 21:00–05:00 window, so an unpinned clock makes
   their tests pass or fail depending on the time of day. NTP is masked in the
diff --git a/vmbox/guest/provision.sh b/vmbox/guest/provision.sh
index 682241a..d045ac9 100644
--- a/vmbox/guest/provision.sh
+++ b/vmbox/guest/provision.sh
@@ -37,6 +37,16 @@ else
     fi
 fi
 
+# QEMU user-mode networking (libslirp 4.9.4 / qemu 11.1.1, measured
+# 2026-09-14) stalls concurrent TCP streams: with 5 parallel 60 MB curls, 2-4
+# of them freeze at ~10 MB and time out while a single stream does 45 MB/s.
+# pacman's default ParallelDownloads = 5 hit it on every upgrade (a 90-package
+# -Syu sat at "500 KB/s" for minutes, then finished in 12 s single-stream).
+# Nothing guest-side fixes slirp (window scaling and rmem were tried); one
+# stream at a time is the whole fix.
+sed -i 's/^#*ParallelDownloads.*/ParallelDownloads = 1/' /etc/pacman.conf
+grep -q '^ParallelDownloads' /etc/pacman.conf || echo 'ParallelDownloads = 1' >> /etc/pacman.conf
+
 # The cloud image ships an empty package DB; -Syu also picks up any security
 # fixes since the image was cut.
 pacman -Syu --noconfirm --needed \