diff --git a/nixos/doc/manual/release-notes/rl-2009.xml b/nixos/doc/manual/release-notes/rl-2009.xml
index e599820d965e..ff61108d7cbf 100644
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@@ -116,15 +116,24 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
       MySQL server is now started with additional systemd sandbox/hardening options for better security. The PrivateTmp, ProtectHome, and ProtectSystem options
       may be problematic when MySQL is attempting to read from or write to your filesystem anywhere outside of its own state directory, for example when
       calling <literal>LOAD DATA INFILE or SELECT * INTO OUTFILE</literal>. In this scenario a variant of the following may be required:
-        - allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
+      <itemizedlist>
+       <listitem>
+        <para>allow MySQL to read from /home and /tmp directories when using <literal>LOAD DATA INFILE</literal>
 <programlisting>
 systemd.services.mysql.serviceConfig.ProtectHome = lib.mkForce "read-only";
 </programlisting>
-        - allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
-          access to <literal>/var/data</literal>
+        </para>
+       </listitem>
+      <listitem>
+       <para>
+        allow MySQL to write to custom folder <literal>/var/data</literal> when using <literal>SELECT * INTO OUTFILE</literal>, assuming the mysql user has write
+        access to <literal>/var/data</literal>
 <programlisting>
 systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
 </programlisting>
+</para>
+      </listitem>
+     </itemizedlist>
     </para>
     <para>
       The MySQL service no longer runs its <literal>systemd</literal> service startup script as <literal>root</literal> anymore. A dedicated non <literal>root</literal>