diff --git a/pkg/sentry/socket/netfilter/extensions.go b/pkg/sentry/socket/netfilter/extensions.go
index 56ced4ae6..7dc6379ad 100644
--- a/pkg/sentry/socket/netfilter/extensions.go
+++ b/pkg/sentry/socket/netfilter/extensions.go
@@ -24,7 +24,7 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
 
-// matchMaker knows how to (un)marshal the matcher named name(). UPDATE THIS
+// matchMaker knows how to (un)marshal the matcher named name().
 type matchMaker interface {
 	// name is the matcher name as stored in the xt_entry_match struct.
 	name() string
diff --git a/pkg/sentry/socket/netfilter/netfilter.go b/pkg/sentry/socket/netfilter/netfilter.go
index ee99c8ecb..1d20350c0 100644
--- a/pkg/sentry/socket/netfilter/netfilter.go
+++ b/pkg/sentry/socket/netfilter/netfilter.go
@@ -35,7 +35,7 @@ import (
 // enableLogging controls whether to log the (de)serialization of netfilter
 // structs between userspace and netstack. These logs are useful when
 // developing iptables, but can pollute sentry logs otherwise.
-const enableLogging = true
+const enableLogging = false
 
 // nflog logs messages related to the writing and reading of iptables.
 func nflog(format string, args ...any) {