diff --git a/crowdsec/README.md b/crowdsec/README.md
index c1fba29..a78b705 100644
--- a/crowdsec/README.md
+++ b/crowdsec/README.md
@@ -181,8 +181,7 @@ probes blocked on the non-excluded routes. The cost is precise: on an excluded
 route (say the Forgejo API) generic SQLi/XSS now passes to the app, while
 virtual patching still catches known CVEs there, and on a non-excluded host
 (vault, status) the full CRS applies. Latency added over vpatch: about +2 ms
-time-to-first-byte per request. RAM: see the episode notes; CRS settles around
-the same order as vpatch once loaded, roughly +15 to 40 MB.
+time-to-first-byte per request. RAM measured settled: +9 MB over vpatch after five minutes (vpatch ~184 MB, CRS+exclusions ~193 MB). The ~25-45 MB people cite is a load-time peak, not the steady cost.
 
 Traps found while tuning:
 - `RemoveInBandRuleByName("crowdsecurity/crs")` in a `pre_eval` hook does **not**