diff --git a/.github/workflows/beekeeper.yml b/.github/workflows/beekeeper.yml
index 0cb7c41fe2f..e23b990b34f 100644
--- a/.github/workflows/beekeeper.yml
+++ b/.github/workflows/beekeeper.yml
@@ -19,7 +19,7 @@ env:
   SETUP_CONTRACT_IMAGE: "ethersphere/bee-localchain"
   SETUP_CONTRACT_IMAGE_TAG: "0.9.4"
   BEELOCAL_BRANCH: "main"
-  BEEKEEPER_BRANCH: "master"
+  BEEKEEPER_BRANCH: "refactor/node-mode-config"
   BEEKEEPER_METRICS_ENABLED: false
   REACHABILITY_OVERRIDE_PUBLIC: true
   BATCHFACTOR_OVERRIDE_PUBLIC: 2
diff --git a/cmd/bee/cmd/cmd.go b/cmd/bee/cmd/cmd.go
index eb09b03021a..2c357923501 100644
--- a/cmd/bee/cmd/cmd.go
+++ b/cmd/bee/cmd/cmd.go
@@ -52,11 +52,12 @@ const (
 	optionNameBootnodeMode                 = "bootnode-mode"
 	optionNameSwapFactoryAddress           = "swap-factory-address"
 	optionNameSwapInitialDeposit           = "swap-initial-deposit"
+	optionNameNodeMode                     = "node-mode"
 	optionNameSwapEnable                   = "swap-enable"
 	optionNameChequebookEnable             = "chequebook-enable"
 	optionNameChequebookVerification       = "chequebook-verification"
 	optionNameChequebookMinBalance         = "chequebook-min-balance"
-	optionNameFullNode                     = "full-node"
+	optionNameFullNode                     = "full-node" // Deprecated: use node-mode instead.
 	optionNamePostageContractAddress       = "postage-stamp-address"
 	optionNamePostageContractStartBlock    = "postage-stamp-start-block"
 	optionNamePriceOracleAddress           = "price-oracle-address"
@@ -302,11 +303,15 @@ func (c *command) setAllFlags(cmd *cobra.Command) {
 	cmd.Flags().Duration(optionNameBlockchainRpcKeepalive, 30*time.Second, "blockchain rpc TCP keepalive interval")
 	cmd.Flags().String(optionNameSwapFactoryAddress, "", "swap factory addresses")
 	cmd.Flags().String(optionNameSwapInitialDeposit, "0", "initial deposit if deploying a new chequebook")
+	cmd.Flags().String(optionNameNodeMode, string(node.UltraLightMode), "node operational mode: full, light, or ultra-light")
 	cmd.Flags().Bool(optionNameSwapEnable, false, "enable swap")
-	cmd.Flags().Bool(optionNameChequebookEnable, true, "enable chequebook")
+	cmd.Flags().Bool(optionNameChequebookEnable, false, "enable chequebook (requires swap-enable)")
 	cmd.Flags().Bool(optionNameChequebookVerification, false, "reject full-node hive/handshake records that carry no chequebook address")
 	cmd.Flags().String(optionNameChequebookMinBalance, "110000000000000000", "minimum chequebook token balance required for verification, in token small units (default 11 BZZ)")
-	cmd.Flags().Bool(optionNameFullNode, false, "cause the node to start in full mode")
+	cmd.Flags().Bool(optionNameFullNode, false, "cause the node to start in full mode (deprecated: use --node-mode=full)")
+	if err := cmd.Flags().MarkDeprecated(optionNameFullNode, "use --node-mode=full instead"); err != nil {
+		panic(err)
+	}
 	cmd.Flags().String(optionNamePostageContractAddress, "", "postage stamp contract address")
 	cmd.Flags().Uint64(optionNamePostageContractStartBlock, 0, "postage stamp contract start block number")
 	cmd.Flags().String(optionNamePriceOracleAddress, "", "price oracle contract address")
@@ -322,7 +327,7 @@ func (c *command) setAllFlags(cmd *cobra.Command) {
 	cmd.Flags().Bool(optionNamePProfMutex, false, "enable pprof mutex profile")
 	cmd.Flags().StringSlice(optionNameStaticNodes, []string{}, "protect nodes from getting kicked out on bootnode")
 	cmd.Flags().Bool(optionNameAllowPrivateCIDRs, false, "allow to advertise private CIDRs to the public network")
-	cmd.Flags().Bool(optionNameStorageIncentivesEnable, true, "enable storage incentives feature")
+	cmd.Flags().Bool(optionNameStorageIncentivesEnable, false, "enable storage incentives feature (full node only)")
 	cmd.Flags().Uint64(optionNameStateStoreCacheCapacity, 100_000, "lru memory caching capacity in number of statestore entries")
 	cmd.Flags().String(optionNameTargetNeighborhood, "", "neighborhood to target in binary format (ex: 111111001) for mining the initial overlay")
 	cmd.Flags().String(optionNameNeighborhoodSuggester, "https://api.swarmscan.io/v1/network/neighborhoods/suggestion", "suggester for target neighborhood")
diff --git a/cmd/bee/cmd/resolve_node_mode_test.go b/cmd/bee/cmd/resolve_node_mode_test.go
new file mode 100644
index 00000000000..43c051f7cb7
--- /dev/null
+++ b/cmd/bee/cmd/resolve_node_mode_test.go
@@ -0,0 +1,281 @@
+// Copyright 2026 The Swarm Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/ethersphere/bee/v2/pkg/log"
+	"github.com/ethersphere/bee/v2/pkg/node"
+	"github.com/spf13/viper"
+)
+
+func TestResolveNodeMode(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   map[string]any
+		wantMode node.NodeMode
+		wantErr  string
+	}{
+		// ── Explicit node-mode: strict validation ────────────────────────────────
+		{
+			name: "full mode with rpc, swap, chequebook and incentives succeeds",
+			config: map[string]any{
+				optionNameNodeMode:                "full",
+				configKeyBlockchainRpcEndpoint:    "http://localhost:8545",
+				optionNameSwapEnable:              true,
+				optionNameChequebookEnable:        true,
+				optionNameStorageIncentivesEnable: true,
+			},
+			wantMode: node.FullMode,
+		},
+		{
+			name: "full mode without rpc fails",
+			config: map[string]any{
+				optionNameNodeMode:   "full",
+				optionNameSwapEnable: true,
+			},
+			wantErr: "full node requires blockchain-rpc-endpoint",
+		},
+		{
+			name: "full mode without swap fails",
+			config: map[string]any{
+				optionNameNodeMode:             "full",
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+			},
+			wantErr: "full node requires swap-enable",
+		},
+		{
+			name: "full mode without chequebook fails",
+			config: map[string]any{
+				optionNameNodeMode:                "full",
+				configKeyBlockchainRpcEndpoint:    "http://localhost:8545",
+				optionNameSwapEnable:              true,
+				optionNameStorageIncentivesEnable: true,
+			},
+			wantErr: "full node requires chequebook-enable",
+		},
+		{
+			name: "full mode without storage-incentives fails",
+			config: map[string]any{
+				optionNameNodeMode:             "full",
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+				optionNameSwapEnable:           true,
+				optionNameChequebookEnable:     true,
+			},
+			wantErr: "storage-incentives-enable",
+		},
+		{
+			name: "chequebook-enable without swap-enable fails (light mode)",
+			config: map[string]any{
+				optionNameNodeMode:             "light",
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+				optionNameChequebookEnable:     true,
+			},
+			wantErr: "chequebook-enable requires swap-enable",
+		},
+		{
+			name: "light mode with rpc succeeds",
+			config: map[string]any{
+				optionNameNodeMode:             "light",
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+			},
+			wantMode: node.LightMode,
+		},
+		{
+			name: "light mode without rpc fails",
+			config: map[string]any{
+				optionNameNodeMode: "light",
+			},
+			wantErr: "light node requires blockchain-rpc-endpoint",
+		},
+		{
+			name: "ultra-light mode succeeds",
+			config: map[string]any{
+				optionNameNodeMode: "ultra-light",
+			},
+			wantMode: node.UltraLightMode,
+		},
+		{
+			name: "ultra-light mode rejects swap-enable",
+			config: map[string]any{
+				optionNameNodeMode:   "ultra-light",
+				optionNameSwapEnable: true,
+			},
+			wantErr: "ultra-light node cannot have swap-enable",
+		},
+		{
+			name: "invalid node-mode value fails",
+			config: map[string]any{
+				optionNameNodeMode: "superlight",
+			},
+			wantErr: "invalid node-mode",
+		},
+
+		// ── Legacy path: no node-mode set ────────────────────────────────────────
+		{
+			name: "legacy full-node true with all required flags maps to full mode",
+			config: map[string]any{
+				optionNameFullNode:                true,
+				configKeyBlockchainRpcEndpoint:    "http://localhost:8545",
+				optionNameSwapEnable:              true,
+				optionNameChequebookEnable:        true,
+				optionNameStorageIncentivesEnable: true,
+			},
+			wantMode: node.FullMode,
+		},
+		{
+			// Upgrade compatibility: chequebook-enable and storage-incentives-enable
+			// defaulted to true before node-mode existed. A legacy --full-node
+			// config that did not set them explicitly is auto-enabled so the node
+			// still starts as a fully-functional full node instead of failing
+			// validation (no silent degradation).
+			name: "legacy full-node true auto-enables chequebook and incentives",
+			config: map[string]any{
+				optionNameFullNode:             true,
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+				optionNameSwapEnable:           true,
+			},
+			wantMode: node.FullMode,
+		},
+		{
+			// The compatibility default only restores the old implicit value; an
+			// operator who explicitly disables chequebook while requesting a full
+			// node has a genuine misconfiguration that must still fail loudly.
+			name: "legacy full-node true with chequebook explicitly false fails",
+			config: map[string]any{
+				optionNameFullNode:             true,
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+				optionNameSwapEnable:           true,
+				optionNameChequebookEnable:     false,
+			},
+			wantErr: "full node requires chequebook-enable",
+		},
+		{
+			// Same: explicitly disabling storage incentives must not be masked.
+			name: "legacy full-node true with storage-incentives explicitly false fails",
+			config: map[string]any{
+				optionNameFullNode:                true,
+				configKeyBlockchainRpcEndpoint:    "http://localhost:8545",
+				optionNameSwapEnable:              true,
+				optionNameChequebookEnable:        true,
+				optionNameStorageIncentivesEnable: false,
+			},
+			wantErr: "storage-incentives-enable",
+		},
+		{
+			// swap-enable was also implied by --full-node before node-mode; a
+			// legacy config with only the RPC endpoint set is fully restored and
+			// starts as a full node rather than failing.
+			name: "legacy full-node true with only rpc auto-enables full stack",
+			config: map[string]any{
+				optionNameFullNode:             true,
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+			},
+			wantMode: node.FullMode,
+		},
+		{
+			// The RPC endpoint is the one thing the compatibility default cannot
+			// invent; a legacy full-node config without it must still fail.
+			name: "legacy full-node true without rpc endpoint fails",
+			config: map[string]any{
+				optionNameFullNode: true,
+			},
+			wantErr: "full node requires blockchain-rpc-endpoint",
+		},
+		{
+			name: "legacy with rpc endpoint infers light mode",
+			config: map[string]any{
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+			},
+			wantMode: node.LightMode,
+		},
+		{
+			name:     "legacy without rpc endpoint infers ultra-light mode",
+			config:   map[string]any{},
+			wantMode: node.UltraLightMode,
+		},
+		{
+			// Beekeeper's inherited-config scenario: rpc + swap-enable without node-mode.
+			// Legacy path must NOT apply strict swap validation; this was the CI regression.
+			name: "legacy with rpc and swap-enable infers light without error",
+			config: map[string]any{
+				configKeyBlockchainRpcEndpoint: "http://localhost:8545",
+				optionNameSwapEnable:           true,
+			},
+			wantMode: node.LightMode,
+		},
+		{
+			// Same scenario but for ultra-light: no rpc, swap-enable inherited from base.
+			name: "legacy without rpc but with swap-enable infers ultra-light without error",
+			config: map[string]any{
+				optionNameSwapEnable: true,
+			},
+			wantMode: node.UltraLightMode,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &command{
+				config: viper.New(),
+				logger: log.Noop,
+			}
+			for k, v := range tt.config {
+				c.config.Set(k, v)
+			}
+
+			gotMode, err := c.resolveNodeMode(c.logger)
+
+			if tt.wantErr != "" {
+				if err == nil {
+					t.Fatalf("expected error containing %q, got nil (mode=%q)", tt.wantErr, gotMode)
+				}
+				if !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("expected error containing %q, got %q", tt.wantErr, err.Error())
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if gotMode != tt.wantMode {
+				t.Errorf("got mode %q, want %q", gotMode, tt.wantMode)
+			}
+		})
+	}
+}
+
+// TestResolveNodeModeLegacyBackcompatWritesConfig verifies that the legacy
+// --full-node compatibility path writes the restored swap-enable,
+// chequebook-enable and storage-incentives-enable defaults back into the
+// config, so the rest of node startup (which reads them directly from config)
+// sees them enabled.
+func TestResolveNodeModeLegacyBackcompatWritesConfig(t *testing.T) {
+	c := &command{
+		config: viper.New(),
+		logger: log.Noop,
+	}
+	c.config.Set(optionNameFullNode, true)
+	c.config.Set(configKeyBlockchainRpcEndpoint, "http://localhost:8545")
+
+	mode, err := c.resolveNodeMode(c.logger)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mode != node.FullMode {
+		t.Fatalf("got mode %q, want %q", mode, node.FullMode)
+	}
+	for _, key := range []string{
+		optionNameSwapEnable,
+		optionNameChequebookEnable,
+		optionNameStorageIncentivesEnable,
+	} {
+		if !c.config.GetBool(key) {
+			t.Errorf("expected %q to be written back as true", key)
+		}
+	}
+}
diff --git a/cmd/bee/cmd/start.go b/cmd/bee/cmd/start.go
index 0e13c75ccb3..34b697ba9f3 100644
--- a/cmd/bee/cmd/start.go
+++ b/cmd/bee/cmd/start.go
@@ -208,9 +208,13 @@ func buildBeeNode(ctx context.Context, c *command, cmd *cobra.Command, logger lo
 	}
 
 	bootNode := c.config.GetBool(optionNameBootnodeMode)
-	fullNode := c.config.GetBool(optionNameFullNode)
 
-	if bootNode && !fullNode {
+	nodeMode, err := c.resolveNodeMode(logger)
+	if err != nil {
+		return nil, err
+	}
+
+	if bootNode && nodeMode != node.FullMode {
 		return nil, errors.New("boot node must be started as a full node")
 	}
 
@@ -318,7 +322,7 @@ func buildBeeNode(ctx context.Context, c *command, cmd *cobra.Command, logger lo
 		EnableWS:                      c.config.GetBool(optionNameP2PWSEnable),
 		AutoTLSDomain:                 c.config.GetString(optionAutoTLSDomain),
 		AutoTLSRegistrationEndpoint:   c.config.GetString(optionAutoTLSRegistrationEndpoint),
-		FullNodeMode:                  fullNode,
+		NodeMode:                      nodeMode,
 		Logger:                        logger,
 		MinimumGasTipCap:              c.config.GetUint64(optionNameMinimumGasTipCap),
 		GasLimitFallback:              c.config.GetUint64(optionNameGasLimitFallback),
@@ -358,6 +362,109 @@ func buildBeeNode(ctx context.Context, c *command, cmd *cobra.Command, logger lo
 	return b, err
 }
 
+// resolveNodeMode determines the effective node mode from config.
+// --node-mode takes precedence and triggers strict per-mode validation.
+// The deprecated --full-node flag is honoured as a fallback and validated
+// the same way when it requests full mode, so upgraders relying on the old
+// chequebook-enable / storage-incentives-enable defaults fail loudly instead
+// of silently degrading to pseudo-settle / no incentives.
+// When neither is set, mode is inferred from blockchain-rpc-endpoint presence
+// (legacy behaviour) without strict validation, for backward compatibility.
+func (c *command) resolveNodeMode(logger log.Logger) (node.NodeMode, error) {
+	// Backward compatibility: before node-mode existed, --full-node implied a
+	// full node with swap, chequebook and storage incentives (chequebook and
+	// incentives even defaulted to true). With the new explicit defaults a
+	// legacy --full-node config that relied on them would fail strict full-mode
+	// validation and the node would not start. When --full-node is used as the
+	// legacy selector (node-mode unset), restore those implied values for any
+	// the operator did not set explicitly, so the upgraded node keeps running as
+	// a fully-functional full node (no silent degradation) instead of failing to
+	// start. Explicitly disabled options are left untouched and still fail
+	// validation below. The values are written back to config so the rest of
+	// node startup picks them up.
+	if c.config.GetBool(optionNameFullNode) && !c.config.IsSet(optionNameNodeMode) {
+		logger.Warning("--full-node is deprecated, use --node-mode=full instead")
+		for _, key := range []string{
+			optionNameSwapEnable,
+			optionNameChequebookEnable,
+			optionNameStorageIncentivesEnable,
+		} {
+			if !c.config.IsSet(key) {
+				logger.Warning("enabling option implied by legacy --full-node; set it explicitly or use --node-mode=full", "option", key)
+				c.config.Set(key, true)
+			}
+		}
+	}
+
+	rpcEndpoint := c.config.GetString(configKeyBlockchainRpcEndpoint)
+	swapEnable := c.config.GetBool(optionNameSwapEnable)
+	chequebookEnable := c.config.GetBool(optionNameChequebookEnable)
+	incentivesEnable := c.config.GetBool(optionNameStorageIncentivesEnable)
+
+	// chequebook init is gated on swap-enable in NewBee, so this combo is a
+	// silent no-op. Catch it eagerly regardless of mode.
+	if chequebookEnable && !swapEnable {
+		return "", errors.New("chequebook-enable requires swap-enable to be true")
+	}
+
+	validateFullMode := func() error {
+		if rpcEndpoint == "" {
+			return errors.New("full node requires blockchain-rpc-endpoint to be set")
+		}
+		if !swapEnable {
+			return errors.New("full node requires swap-enable to be true")
+		}
+		if !chequebookEnable {
+			return errors.New("full node requires chequebook-enable to be true (cheque issuance)")
+		}
+		if !incentivesEnable {
+			return errors.New("full node requires storage-incentives-enable to be true")
+		}
+		return nil
+	}
+
+	if c.config.IsSet(optionNameNodeMode) {
+		mode := node.NodeMode(c.config.GetString(optionNameNodeMode))
+		if !mode.IsValid() {
+			return "", fmt.Errorf("invalid node-mode %q: must be one of full, light, ultra-light", mode)
+		}
+		if c.config.GetBool(optionNameFullNode) {
+			logger.Warning("--full-node is set alongside --node-mode; --full-node is ignored")
+		}
+		switch mode {
+		case node.FullMode:
+			if err := validateFullMode(); err != nil {
+				return "", err
+			}
+		case node.LightMode:
+			if rpcEndpoint == "" {
+				return "", errors.New("light node requires blockchain-rpc-endpoint to be set")
+			}
+		case node.UltraLightMode:
+			if swapEnable {
+				return "", errors.New("ultra-light node cannot have swap-enable set to true")
+			}
+		}
+		return mode, nil
+	}
+
+	// Legacy path: node-mode not set. --full-node requests full mode; implied
+	// options were restored above, so any remaining failure is a genuine
+	// misconfiguration (missing rpc endpoint, or an explicitly disabled option).
+	if c.config.GetBool(optionNameFullNode) {
+		if err := validateFullMode(); err != nil {
+			return "", err
+		}
+		return node.FullMode, nil
+	}
+
+	// Infer light vs ultra-light from RPC endpoint presence (original behaviour).
+	if rpcEndpoint != "" {
+		return node.LightMode, nil
+	}
+	return node.UltraLightMode, nil
+}
+
 type program struct {
 	start func()
 	stop  func()
diff --git a/packaging/bee.yaml b/packaging/bee.yaml
index 835ab8ba9ed..11692f65ee6 100644
--- a/packaging/bee.yaml
+++ b/packaging/bee.yaml
@@ -1,13 +1,13 @@
 ## Bee configuration - https://docs.ethswarm.org/docs/working-with-bee/configuration
 
-## allow to advertise private CIDRs to the public network
-# allow-private-cidrs: false
-## HTTP API listen address
-# api-addr: 127.0.0.1:1633
-## chain block time
-# block-time: "5"
-## block number cache sync interval in blocks
-# block-sync-interval: 10
+## ── Node mode ────────────────────────────────────────────────────────────────
+## Selects the operational mode of this node.
+##   full        - participates in storage and incentives; requires swap-enable and blockchain-rpc
+##   light       - uploads and downloads only; requires blockchain-rpc
+##   ultra-light - free-tier downloads only; no blockchain connection needed (default)
+# node-mode: ultra-light
+
+## ── Blockchain / RPC (required for full and light nodes) ─────────────────────
 ## blockchain rpc configuration
 # blockchain-rpc:
 #   endpoint: ""
@@ -15,24 +15,98 @@
 #   tls-timeout: 10s
 #   idle-timeout: 90s
 #   keepalive: 30s
+## chain block time
+# block-time: "5"
+## block number cache sync interval in blocks
+# block-sync-interval: 10
+
+## ── Swap / chequebook (full and light nodes only) ────────────────────────────
+## enable swap
+# swap-enable: false
+## enable chequebook
+# chequebook-enable: false
+## reject full-node hive/handshake records that carry no chequebook address
+# chequebook-verification: false
+## swap factory addresses
+# swap-factory-address: ""
+## initial deposit if deploying a new chequebook
+# swap-initial-deposit: "0"
+
+## ── Full node only ────────────────────────────────────────────────────────────
+## enable storage incentives feature
+# storage-incentives-enable: false
+## reserve capacity doubling
+# reserve-capacity-doubling: 0
+## minimum radius storage threshold
+# minimum-storage-radius: "0"
+## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
+# target-neighborhood: ""
+## suggester for target neighborhood
+# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
+## redistribution contract address
+# redistribution-address: ""
+## staking contract address
+# staking-address: ""
+
+## ── Network ───────────────────────────────────────────────────────────────────
+## triggers connect to main net bootnodes
+# mainnet: true
+## ID of the Swarm network
+# network-id: "1"
 ## initial nodes to connect to
 # bootnode: ["/dnsaddr/mainnet.ethswarm.org"]
 ## cause the node to always accept incoming connections
 # bootnode-mode: false
-## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
-# cache-capacity: "1000000"
-## enable forwarded content caching
-# cache-retrieval: true
-## enable chequebook
-# chequebook-enable: true
-## reject full-node hive/handshake records that carry no chequebook address
-# chequebook-verification: false
-## config file (default is $HOME/.bee.yaml)
-config: "/etc/bee/bee.yaml"
+## protect nodes from getting kicked out on bootnode
+# static-nodes: []
+## P2P listen address
+# p2p-addr: :1634
+## enable P2P WebSocket transport
+# p2p-ws-enable: false
+## enable wss p2p connections
+# p2p-wss-enable: false
+## wss address
+# p2p-wss-addr: :1635
+## NAT exposed address
+# nat-addr: ""
+## WSS NAT exposed address
+# nat-wss-addr: ""
+## autotls domain
+# autotls-domain: ""
+## autotls registration endpoint
+# autotls-registration-endpoint: ""
+## autotls ca endpoint
+# autotls-ca-endpoint: ""
+## allow to advertise private CIDRs to the public network
+# allow-private-cidrs: false
+
+## ── HTTP API ──────────────────────────────────────────────────────────────────
+## HTTP API listen address
+# api-addr: 127.0.0.1:1633
 ## origins with CORS headers enabled
 # cors-allowed-origins: []
+
+## ── Storage ───────────────────────────────────────────────────────────────────
 ## data directory
 data-dir: "/var/lib/bee"
+## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
+# cache-capacity: "1000000"
+## enable forwarded content caching
+# cache-retrieval: true
+## postage stamp contract address
+# postage-stamp-address: ""
+## postage stamp contract start block number
+# postage-stamp-start-block: "0"
+## skip postage snapshot
+# skip-postage-snapshot: false
+## forces the node to resync postage contract data
+# resync: false
+## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
+# resolver-options: []
+## price oracle contract address
+# price-oracle-address: ""
+
+## ── Database ──────────────────────────────────────────────────────────────────
 ## size of block cache of the database in bytes
 # db-block-cache-capacity: "33554432"
 ## disables db compactions triggered by seeks
@@ -41,72 +115,36 @@ data-dir: "/var/lib/bee"
 # db-open-files-limit: "200"
 ## size of the database write buffer in bytes
 # db-write-buffer-size: "33554432"
-## cause the node to start in full mode
-# full-node: false
-## help for printconfig
-# help: false
-## triggers connect to main net bootnodes.
-# mainnet: true
+## lru memory caching capacity in number of statestore entries
+# statestore-cache-capacity: "100000"
+
+## ── Payments ──────────────────────────────────────────────────────────────────
+## threshold in BZZ where you expect to get paid from your peers
+# payment-threshold: "13500000"
+## percentage below the peers payment threshold when we initiate settlement
+# payment-early-percent: 50
+## excess debt above payment threshold in percentages where you disconnect from your peer
+# payment-tolerance-percent: 25
 ## minimum gas tip cap in wei for transactions, 0 means use suggested gas tip cap
 # minimum-gas-tip-cap: 0
-## minimum radius storage threshold
-# minimum-storage-radius: "0"
-## NAT exposed address
-# nat-addr: ""
-## suggester for target neighborhood
-# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
-## ID of the Swarm network
-# network-id: "1"
-## P2P listen address
-# p2p-addr: :1634
-## enable P2P WebSocket transport
-# p2p-ws-enable: false
+## gas limit fallback when estimation fails for contract transactions (default 500000)
+# gas-limit-fallback: 500000
+## skips the gas estimate step for contract transactions
+# transaction-debug-mode: false
+## withdrawal target addresses
+# withdrawal-addresses-whitelist: []
+
+## ── Keys / identity ───────────────────────────────────────────────────────────
+## config file (default is $HOME/.bee.yaml)
+config: "/etc/bee/bee.yaml"
 ## password for decrypting keys
 # password: ""
 ## path to a file that contains password for decrypting keys
 password-file: "/var/lib/bee/password"
-## percentage below the peers payment threshold when we initiate settlement
-# payment-early-percent: 50
-## threshold in BZZ where you expect to get paid from your peers
-# payment-threshold: "13500000"
-## excess debt above payment threshold in percentages where you disconnect from your peer
-# payment-tolerance-percent: 25
-## postage stamp contract address
-# postage-stamp-address: ""
-## postage stamp contract start block number
-# postage-stamp-start-block: "0"
-## enable pprof mutex profile
-# pprof-mutex: false
-## enable pprof block profile
-# pprof-profile: false
-## price oracle contract address
-# price-oracle-address: ""
-## redistribution contract address
-# redistribution-address: ""
-## reserve capacity doubling
-# reserve-capacity-doubling: 0
-## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
-# resolver-options: []
-## forces the node to resync postage contract data
-# resync: false
-## skip postage snapshot
-# skip-postage-snapshot: false
-## staking contract address
-# staking-address: ""
-## lru memory caching capacity in number of statestore entries
-# statestore-cache-capacity: "100000"
-## protect nodes from getting kicked out on bootnode
-# static-nodes: []
-## enable storage incentives feature
-# storage-incentives-enable: true
-## enable swap
-# swap-enable: false
-## swap factory addresses
-# swap-factory-address: ""
-## initial deposit if deploying a new chequebook
-# swap-initial-deposit: "0"
-## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
-# target-neighborhood: ""
+
+## ── Logging / tracing ─────────────────────────────────────────────────────────
+## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
+# verbosity: info
 ## enable tracing
 # tracing-enable: false
 ## endpoint to send tracing data
@@ -117,29 +155,15 @@ password-file: "/var/lib/bee/password"
 # tracing-port: ""
 ## service name identifier for tracing
 # tracing-service-name: bee
-## gas limit fallback when estimation fails for contract transactions (default 500000)
-# gas-limit-fallback: 500000
-## skips the gas estimate step for contract transactions
-# transaction-debug-mode: false
-## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
-# verbosity: info
+## enable pprof mutex profile
+# pprof-mutex: false
+## enable pprof block profile
+# pprof-profile: false
+
+## ── Miscellaneous ─────────────────────────────────────────────────────────────
 ## maximum node warmup duration; proceeds when stable or after this time
 # warmup-time: 5m0s
 ## send a welcome message string during handshakes
 # welcome-message: ""
-## withdrawal target addresses
-# withdrawal-addresses-whitelist: []
-## enable wss p2p connections (default: false)
-# p2p-wss-enable: false
-## wss address (default: :1635)
-# p2p-wss-addr: :1635
-## WSS NAT exposed address
-# nat-wss-addr: ""
-## autotls domain (default: libp2p.direct)
-# autotls-domain: ""
-## autotls registration endpoint (default: https://registration.libp2p.direct)
-# autotls-registration-endpoint: ""
-## autotls ca endpoint (default: https://acme-v02.api.letsencrypt.org/directory)
-# autotls-ca-endpoint: ""
 ## SIMD BMT hashing opt-in flag (only available on linux amd64)
 # use-simd-hashing: false
diff --git a/packaging/homebrew-amd64/bee.yaml b/packaging/homebrew-amd64/bee.yaml
index fffe37234c7..89d9009999e 100644
--- a/packaging/homebrew-amd64/bee.yaml
+++ b/packaging/homebrew-amd64/bee.yaml
@@ -1,13 +1,13 @@
 ## Bee configuration - https://docs.ethswarm.org/docs/working-with-bee/configuration
 
-## allow to advertise private CIDRs to the public network
-# allow-private-cidrs: false
-## HTTP API listen address
-# api-addr: 127.0.0.1:1633
-## chain block time
-# block-time: "5"
-## block number cache sync interval in blocks
-# block-sync-interval: 10
+## ── Node mode ────────────────────────────────────────────────────────────────
+## Selects the operational mode of this node.
+##   full        - participates in storage and incentives; requires swap-enable and blockchain-rpc
+##   light       - uploads and downloads only; requires blockchain-rpc
+##   ultra-light - free-tier downloads only; no blockchain connection needed (default)
+# node-mode: ultra-light
+
+## ── Blockchain / RPC (required for full and light nodes) ─────────────────────
 ## blockchain rpc configuration
 # blockchain-rpc:
 #   endpoint: ""
@@ -15,24 +15,98 @@
 #   tls-timeout: 10s
 #   idle-timeout: 90s
 #   keepalive: 30s
+## chain block time
+# block-time: "5"
+## block number cache sync interval in blocks
+# block-sync-interval: 10
+
+## ── Swap / chequebook (full and light nodes only) ────────────────────────────
+## enable swap
+# swap-enable: false
+## enable chequebook
+# chequebook-enable: false
+## reject full-node hive/handshake records that carry no chequebook address
+# chequebook-verification: false
+## swap factory addresses
+# swap-factory-address: ""
+## initial deposit if deploying a new chequebook
+# swap-initial-deposit: "0"
+
+## ── Full node only ────────────────────────────────────────────────────────────
+## enable storage incentives feature
+# storage-incentives-enable: false
+## reserve capacity doubling
+# reserve-capacity-doubling: 0
+## minimum radius storage threshold
+# minimum-storage-radius: "0"
+## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
+# target-neighborhood: ""
+## suggester for target neighborhood
+# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
+## redistribution contract address
+# redistribution-address: ""
+## staking contract address
+# staking-address: ""
+
+## ── Network ───────────────────────────────────────────────────────────────────
+## triggers connect to main net bootnodes
+# mainnet: true
+## ID of the Swarm network
+# network-id: "1"
 ## initial nodes to connect to
 # bootnode: ["/dnsaddr/mainnet.ethswarm.org"]
 ## cause the node to always accept incoming connections
 # bootnode-mode: false
-## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
-# cache-capacity: "1000000"
-## enable forwarded content caching
-# cache-retrieval: true
-## enable chequebook
-# chequebook-enable: true
-## reject full-node hive/handshake records that carry no chequebook address
-# chequebook-verification: false
-## config file (default is $HOME/.bee.yaml)
-config: "/usr/local/etc/swarm-bee/bee.yaml"
+## protect nodes from getting kicked out on bootnode
+# static-nodes: []
+## P2P listen address
+# p2p-addr: :1634
+## enable P2P WebSocket transport
+# p2p-ws-enable: false
+## enable wss p2p connections
+# p2p-wss-enable: false
+## wss address
+# p2p-wss-addr: :1635
+## NAT exposed address
+# nat-addr: ""
+## WSS NAT exposed address
+# nat-wss-addr: ""
+## autotls domain
+# autotls-domain: ""
+## autotls registration endpoint
+# autotls-registration-endpoint: ""
+## autotls ca endpoint
+# autotls-ca-endpoint: ""
+## allow to advertise private CIDRs to the public network
+# allow-private-cidrs: false
+
+## ── HTTP API ──────────────────────────────────────────────────────────────────
+## HTTP API listen address
+# api-addr: 127.0.0.1:1633
 ## origins with CORS headers enabled
 # cors-allowed-origins: []
+
+## ── Storage ───────────────────────────────────────────────────────────────────
 ## data directory
 data-dir: "/usr/local/var/lib/swarm-bee"
+## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
+# cache-capacity: "1000000"
+## enable forwarded content caching
+# cache-retrieval: true
+## postage stamp contract address
+# postage-stamp-address: ""
+## postage stamp contract start block number
+# postage-stamp-start-block: "0"
+## skip postage snapshot
+# skip-postage-snapshot: false
+## forces the node to resync postage contract data
+# resync: false
+## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
+# resolver-options: []
+## price oracle contract address
+# price-oracle-address: ""
+
+## ── Database ──────────────────────────────────────────────────────────────────
 ## size of block cache of the database in bytes
 # db-block-cache-capacity: "33554432"
 ## disables db compactions triggered by seeks
@@ -41,72 +115,36 @@ data-dir: "/usr/local/var/lib/swarm-bee"
 # db-open-files-limit: "200"
 ## size of the database write buffer in bytes
 # db-write-buffer-size: "33554432"
-## cause the node to start in full mode
-# full-node: false
-## help for printconfig
-# help: false
-## triggers connect to main net bootnodes.
-# mainnet: true
+## lru memory caching capacity in number of statestore entries
+# statestore-cache-capacity: "100000"
+
+## ── Payments ──────────────────────────────────────────────────────────────────
+## threshold in BZZ where you expect to get paid from your peers
+# payment-threshold: "13500000"
+## percentage below the peers payment threshold when we initiate settlement
+# payment-early-percent: 50
+## excess debt above payment threshold in percentages where you disconnect from your peer
+# payment-tolerance-percent: 25
 ## minimum gas tip cap in wei for transactions, 0 means use suggested gas tip cap
 # minimum-gas-tip-cap: 0
-## minimum radius storage threshold
-# minimum-storage-radius: "0"
-## NAT exposed address
-# nat-addr: ""
-## suggester for target neighborhood
-# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
-## ID of the Swarm network
-# network-id: "1"
-## P2P listen address
-# p2p-addr: :1634
-## enable P2P WebSocket transport
-# p2p-ws-enable: false
+## gas limit fallback when estimation fails for contract transactions (default 500000)
+# gas-limit-fallback: 500000
+## skips the gas estimate step for contract transactions
+# transaction-debug-mode: false
+## withdrawal target addresses
+# withdrawal-addresses-whitelist: []
+
+## ── Keys / identity ───────────────────────────────────────────────────────────
+## config file (default is $HOME/.bee.yaml)
+config: "/usr/local/etc/swarm-bee/bee.yaml"
 ## password for decrypting keys
 # password: ""
 ## path to a file that contains password for decrypting keys
 password-file: "/usr/local/var/lib/swarm-bee/password"
-## percentage below the peers payment threshold when we initiate settlement
-# payment-early-percent: 50
-## threshold in BZZ where you expect to get paid from your peers
-# payment-threshold: "13500000"
-## excess debt above payment threshold in percentages where you disconnect from your peer
-# payment-tolerance-percent: 25
-## postage stamp contract address
-# postage-stamp-address: ""
-## postage stamp contract start block number
-# postage-stamp-start-block: "0"
-## enable pprof mutex profile
-# pprof-mutex: false
-## enable pprof block profile
-# pprof-profile: false
-## price oracle contract address
-# price-oracle-address: ""
-## redistribution contract address
-# redistribution-address: ""
-## reserve capacity doubling
-# reserve-capacity-doubling: 0
-## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
-# resolver-options: []
-## forces the node to resync postage contract data
-# resync: false
-## skip postage snapshot
-# skip-postage-snapshot: false
-## staking contract address
-# staking-address: ""
-## lru memory caching capacity in number of statestore entries
-# statestore-cache-capacity: "100000"
-## protect nodes from getting kicked out on bootnode
-# static-nodes: []
-## enable storage incentives feature
-# storage-incentives-enable: true
-## enable swap
-# swap-enable: false
-## swap factory addresses
-# swap-factory-address: ""
-## initial deposit if deploying a new chequebook
-# swap-initial-deposit: "0"
-## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
-# target-neighborhood: ""
+
+## ── Logging / tracing ─────────────────────────────────────────────────────────
+## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
+# verbosity: info
 ## enable tracing
 # tracing-enable: false
 ## endpoint to send tracing data
@@ -117,29 +155,15 @@ password-file: "/usr/local/var/lib/swarm-bee/password"
 # tracing-port: ""
 ## service name identifier for tracing
 # tracing-service-name: bee
-## gas limit fallback when estimation fails for contract transactions (default 500000)
-# gas-limit-fallback: 500000
-## skips the gas estimate step for contract transactions
-# transaction-debug-mode: false
-## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
-# verbosity: info
+## enable pprof mutex profile
+# pprof-mutex: false
+## enable pprof block profile
+# pprof-profile: false
+
+## ── Miscellaneous ─────────────────────────────────────────────────────────────
 ## maximum node warmup duration; proceeds when stable or after this time
 # warmup-time: 5m0s
 ## send a welcome message string during handshakes
 # welcome-message: ""
-## withdrawal target addresses
-# withdrawal-addresses-whitelist: []
-## enable wss p2p connections (default: false)
-# p2p-wss-enable: false
-## wss address (default: :1635)
-# p2p-wss-addr: :1635
-## WSS NAT exposed address
-# nat-wss-addr: ""
-## autotls domain (default: libp2p.direct)
-# autotls-domain: ""
-## autotls registration endpoint (default: https://registration.libp2p.direct)
-# autotls-registration-endpoint: ""
-## autotls ca endpoint (default: https://acme-v02.api.letsencrypt.org/directory)
-# autotls-ca-endpoint: ""
 ## SIMD BMT hashing opt-in flag (only available on linux amd64)
 # use-simd-hashing: false
diff --git a/packaging/homebrew-arm64/bee.yaml b/packaging/homebrew-arm64/bee.yaml
index 3d908a690c7..7edd162fdf5 100644
--- a/packaging/homebrew-arm64/bee.yaml
+++ b/packaging/homebrew-arm64/bee.yaml
@@ -1,13 +1,13 @@
 ## Bee configuration - https://docs.ethswarm.org/docs/working-with-bee/configuration
 
-## allow to advertise private CIDRs to the public network
-# allow-private-cidrs: false
-## HTTP API listen address
-# api-addr: 127.0.0.1:1633
-## chain block time
-# block-time: "5"
-## block number cache sync interval in blocks
-# block-sync-interval: 10
+## ── Node mode ────────────────────────────────────────────────────────────────
+## Selects the operational mode of this node.
+##   full        - participates in storage and incentives; requires swap-enable and blockchain-rpc
+##   light       - uploads and downloads only; requires blockchain-rpc
+##   ultra-light - free-tier downloads only; no blockchain connection needed (default)
+# node-mode: ultra-light
+
+## ── Blockchain / RPC (required for full and light nodes) ─────────────────────
 ## blockchain rpc configuration
 # blockchain-rpc:
 #   endpoint: ""
@@ -15,24 +15,98 @@
 #   tls-timeout: 10s
 #   idle-timeout: 90s
 #   keepalive: 30s
+## chain block time
+# block-time: "5"
+## block number cache sync interval in blocks
+# block-sync-interval: 10
+
+## ── Swap / chequebook (full and light nodes only) ────────────────────────────
+## enable swap
+# swap-enable: false
+## enable chequebook
+# chequebook-enable: false
+## reject full-node hive/handshake records that carry no chequebook address
+# chequebook-verification: false
+## swap factory addresses
+# swap-factory-address: ""
+## initial deposit if deploying a new chequebook
+# swap-initial-deposit: "0"
+
+## ── Full node only ────────────────────────────────────────────────────────────
+## enable storage incentives feature
+# storage-incentives-enable: false
+## reserve capacity doubling
+# reserve-capacity-doubling: 0
+## minimum radius storage threshold
+# minimum-storage-radius: "0"
+## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
+# target-neighborhood: ""
+## suggester for target neighborhood
+# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
+## redistribution contract address
+# redistribution-address: ""
+## staking contract address
+# staking-address: ""
+
+## ── Network ───────────────────────────────────────────────────────────────────
+## triggers connect to main net bootnodes
+# mainnet: true
+## ID of the Swarm network
+# network-id: "1"
 ## initial nodes to connect to
 # bootnode: ["/dnsaddr/mainnet.ethswarm.org"]
 ## cause the node to always accept incoming connections
 # bootnode-mode: false
-## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
-# cache-capacity: "1000000"
-## enable forwarded content caching
-# cache-retrieval: true
-## enable chequebook
-# chequebook-enable: true
-## reject full-node hive/handshake records that carry no chequebook address
-# chequebook-verification: false
-## config file (default is $HOME/.bee.yaml)
-config: "/opt/homebrew/etc/swarm-bee/bee.yaml"
+## protect nodes from getting kicked out on bootnode
+# static-nodes: []
+## P2P listen address
+# p2p-addr: :1634
+## enable P2P WebSocket transport
+# p2p-ws-enable: false
+## enable wss p2p connections
+# p2p-wss-enable: false
+## wss address
+# p2p-wss-addr: :1635
+## NAT exposed address
+# nat-addr: ""
+## WSS NAT exposed address
+# nat-wss-addr: ""
+## autotls domain
+# autotls-domain: ""
+## autotls registration endpoint
+# autotls-registration-endpoint: ""
+## autotls ca endpoint
+# autotls-ca-endpoint: ""
+## allow to advertise private CIDRs to the public network
+# allow-private-cidrs: false
+
+## ── HTTP API ──────────────────────────────────────────────────────────────────
+## HTTP API listen address
+# api-addr: 127.0.0.1:1633
 ## origins with CORS headers enabled
 # cors-allowed-origins: []
+
+## ── Storage ───────────────────────────────────────────────────────────────────
 ## data directory
 data-dir: "/opt/homebrew/var/lib/swarm-bee"
+## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
+# cache-capacity: "1000000"
+## enable forwarded content caching
+# cache-retrieval: true
+## postage stamp contract address
+# postage-stamp-address: ""
+## postage stamp contract start block number
+# postage-stamp-start-block: "0"
+## skip postage snapshot
+# skip-postage-snapshot: false
+## forces the node to resync postage contract data
+# resync: false
+## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
+# resolver-options: []
+## price oracle contract address
+# price-oracle-address: ""
+
+## ── Database ──────────────────────────────────────────────────────────────────
 ## size of block cache of the database in bytes
 # db-block-cache-capacity: "33554432"
 ## disables db compactions triggered by seeks
@@ -41,72 +115,36 @@ data-dir: "/opt/homebrew/var/lib/swarm-bee"
 # db-open-files-limit: "200"
 ## size of the database write buffer in bytes
 # db-write-buffer-size: "33554432"
-## cause the node to start in full mode
-# full-node: false
-## help for printconfig
-# help: false
-## triggers connect to main net bootnodes.
-# mainnet: true
+## lru memory caching capacity in number of statestore entries
+# statestore-cache-capacity: "100000"
+
+## ── Payments ──────────────────────────────────────────────────────────────────
+## threshold in BZZ where you expect to get paid from your peers
+# payment-threshold: "13500000"
+## percentage below the peers payment threshold when we initiate settlement
+# payment-early-percent: 50
+## excess debt above payment threshold in percentages where you disconnect from your peer
+# payment-tolerance-percent: 25
 ## minimum gas tip cap in wei for transactions, 0 means use suggested gas tip cap
 # minimum-gas-tip-cap: 0
-## minimum radius storage threshold
-# minimum-storage-radius: "0"
-## NAT exposed address
-# nat-addr: ""
-## suggester for target neighborhood
-# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
-## ID of the Swarm network
-# network-id: "1"
-## P2P listen address
-# p2p-addr: :1634
-## enable P2P WebSocket transport
-# p2p-ws-enable: false
+## gas limit fallback when estimation fails for contract transactions (default 500000)
+# gas-limit-fallback: 500000
+## skips the gas estimate step for contract transactions
+# transaction-debug-mode: false
+## withdrawal target addresses
+# withdrawal-addresses-whitelist: []
+
+## ── Keys / identity ───────────────────────────────────────────────────────────
+## config file (default is $HOME/.bee.yaml)
+config: "/opt/homebrew/etc/swarm-bee/bee.yaml"
 ## password for decrypting keys
 # password: ""
 ## path to a file that contains password for decrypting keys
 password-file: "/opt/homebrew/var/lib/swarm-bee/password"
-## percentage below the peers payment threshold when we initiate settlement
-# payment-early-percent: 50
-## threshold in BZZ where you expect to get paid from your peers
-# payment-threshold: "13500000"
-## excess debt above payment threshold in percentages where you disconnect from your peer
-# payment-tolerance-percent: 25
-## postage stamp contract address
-# postage-stamp-address: ""
-## postage stamp contract start block number
-# postage-stamp-start-block: "0"
-## enable pprof mutex profile
-# pprof-mutex: false
-## enable pprof block profile
-# pprof-profile: false
-## price oracle contract address
-# price-oracle-address: ""
-## redistribution contract address
-# redistribution-address: ""
-## reserve capacity doubling
-# reserve-capacity-doubling: 0
-## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
-# resolver-options: []
-## forces the node to resync postage contract data
-# resync: false
-## skip postage snapshot
-# skip-postage-snapshot: false
-## staking contract address
-# staking-address: ""
-## lru memory caching capacity in number of statestore entries
-# statestore-cache-capacity: "100000"
-## protect nodes from getting kicked out on bootnode
-# static-nodes: []
-## enable storage incentives feature
-# storage-incentives-enable: true
-## enable swap
-# swap-enable: false
-## swap factory addresses
-# swap-factory-address: ""
-## initial deposit if deploying a new chequebook
-# swap-initial-deposit: "0"
-## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
-# target-neighborhood: ""
+
+## ── Logging / tracing ─────────────────────────────────────────────────────────
+## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
+# verbosity: info
 ## enable tracing
 # tracing-enable: false
 ## endpoint to send tracing data
@@ -117,29 +155,15 @@ password-file: "/opt/homebrew/var/lib/swarm-bee/password"
 # tracing-port: ""
 ## service name identifier for tracing
 # tracing-service-name: bee
-## gas limit fallback when estimation fails for contract transactions (default 500000)
-# gas-limit-fallback: 500000
-## skips the gas estimate step for contract transactions
-# transaction-debug-mode: false
-## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
-# verbosity: info
+## enable pprof mutex profile
+# pprof-mutex: false
+## enable pprof block profile
+# pprof-profile: false
+
+## ── Miscellaneous ─────────────────────────────────────────────────────────────
 ## maximum node warmup duration; proceeds when stable or after this time
 # warmup-time: 5m0s
 ## send a welcome message string during handshakes
 # welcome-message: ""
-## withdrawal target addresses
-# withdrawal-addresses-whitelist: []
-## enable wss p2p connections (default: false)
-# p2p-wss-enable: false
-## wss address (default: :1635)
-# p2p-wss-addr: :1635
-## WSS NAT exposed address
-# nat-wss-addr: ""
-## autotls domain (default: libp2p.direct)
-# autotls-domain: ""
-## autotls registration endpoint (default: https://registration.libp2p.direct)
-# autotls-registration-endpoint: ""
-## autotls ca endpoint (default: https://acme-v02.api.letsencrypt.org/directory)
-# autotls-ca-endpoint: ""
 ## SIMD BMT hashing opt-in flag (only available on linux amd64)
 # use-simd-hashing: false
diff --git a/packaging/scoop/bee.yaml b/packaging/scoop/bee.yaml
index 32fe5d1f970..df783c23357 100644
--- a/packaging/scoop/bee.yaml
+++ b/packaging/scoop/bee.yaml
@@ -1,13 +1,13 @@
 ## Bee configuration - https://docs.ethswarm.org/docs/working-with-bee/configuration
 
-## allow to advertise private CIDRs to the public network
-# allow-private-cidrs: false
-## HTTP API listen address
-# api-addr: 127.0.0.1:1633
-## chain block time
-# block-time: "5"
-## block number cache sync interval in blocks
-# block-sync-interval: 10
+## ── Node mode ────────────────────────────────────────────────────────────────
+## Selects the operational mode of this node.
+##   full        - participates in storage and incentives; requires swap-enable and blockchain-rpc
+##   light       - uploads and downloads only; requires blockchain-rpc
+##   ultra-light - free-tier downloads only; no blockchain connection needed (default)
+# node-mode: ultra-light
+
+## ── Blockchain / RPC (required for full and light nodes) ─────────────────────
 ## blockchain rpc configuration
 # blockchain-rpc:
 #   endpoint: ""
@@ -15,24 +15,98 @@
 #   tls-timeout: 10s
 #   idle-timeout: 90s
 #   keepalive: 30s
+## chain block time
+# block-time: "5"
+## block number cache sync interval in blocks
+# block-sync-interval: 10
+
+## ── Swap / chequebook (full and light nodes only) ────────────────────────────
+## enable swap
+# swap-enable: false
+## enable chequebook
+# chequebook-enable: false
+## reject full-node hive/handshake records that carry no chequebook address
+# chequebook-verification: false
+## swap factory addresses
+# swap-factory-address: ""
+## initial deposit if deploying a new chequebook
+# swap-initial-deposit: "0"
+
+## ── Full node only ────────────────────────────────────────────────────────────
+## enable storage incentives feature
+# storage-incentives-enable: false
+## reserve capacity doubling
+# reserve-capacity-doubling: 0
+## minimum radius storage threshold
+# minimum-storage-radius: "0"
+## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
+# target-neighborhood: ""
+## suggester for target neighborhood
+# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
+## redistribution contract address
+# redistribution-address: ""
+## staking contract address
+# staking-address: ""
+
+## ── Network ───────────────────────────────────────────────────────────────────
+## triggers connect to main net bootnodes
+# mainnet: true
+## ID of the Swarm network
+# network-id: "1"
 ## initial nodes to connect to
 # bootnode: ["/dnsaddr/mainnet.ethswarm.org"]
 ## cause the node to always accept incoming connections
 # bootnode-mode: false
-## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
-# cache-capacity: "1000000"
-## enable forwarded content caching
-# cache-retrieval: true
-## enable chequebook
-# chequebook-enable: true
-## reject full-node hive/handshake records that carry no chequebook address
-# chequebook-verification: false
-## config file (default is $HOME/.bee.yaml)
-config: "./bee.yaml"
+## protect nodes from getting kicked out on bootnode
+# static-nodes: []
+## P2P listen address
+# p2p-addr: :1634
+## enable P2P WebSocket transport
+# p2p-ws-enable: false
+## enable wss p2p connections
+# p2p-wss-enable: false
+## wss address
+# p2p-wss-addr: :1635
+## NAT exposed address
+# nat-addr: ""
+## WSS NAT exposed address
+# nat-wss-addr: ""
+## autotls domain
+# autotls-domain: ""
+## autotls registration endpoint
+# autotls-registration-endpoint: ""
+## autotls ca endpoint
+# autotls-ca-endpoint: ""
+## allow to advertise private CIDRs to the public network
+# allow-private-cidrs: false
+
+## ── HTTP API ──────────────────────────────────────────────────────────────────
+## HTTP API listen address
+# api-addr: 127.0.0.1:1633
 ## origins with CORS headers enabled
 # cors-allowed-origins: []
+
+## ── Storage ───────────────────────────────────────────────────────────────────
 ## data directory
 data-dir: "./data"
+## cache capacity in chunks, multiply by 4096 to get approximate capacity in bytes
+# cache-capacity: "1000000"
+## enable forwarded content caching
+# cache-retrieval: true
+## postage stamp contract address
+# postage-stamp-address: ""
+## postage stamp contract start block number
+# postage-stamp-start-block: "0"
+## skip postage snapshot
+# skip-postage-snapshot: false
+## forces the node to resync postage contract data
+# resync: false
+## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
+# resolver-options: []
+## price oracle contract address
+# price-oracle-address: ""
+
+## ── Database ──────────────────────────────────────────────────────────────────
 ## size of block cache of the database in bytes
 # db-block-cache-capacity: "33554432"
 ## disables db compactions triggered by seeks
@@ -41,72 +115,36 @@ data-dir: "./data"
 # db-open-files-limit: "200"
 ## size of the database write buffer in bytes
 # db-write-buffer-size: "33554432"
-## cause the node to start in full mode
-# full-node: false
-## help for printconfig
-# help: false
-## triggers connect to main net bootnodes.
-# mainnet: true
+## lru memory caching capacity in number of statestore entries
+# statestore-cache-capacity: "100000"
+
+## ── Payments ──────────────────────────────────────────────────────────────────
+## threshold in BZZ where you expect to get paid from your peers
+# payment-threshold: "13500000"
+## percentage below the peers payment threshold when we initiate settlement
+# payment-early-percent: 50
+## excess debt above payment threshold in percentages where you disconnect from your peer
+# payment-tolerance-percent: 25
 ## minimum gas tip cap in wei for transactions, 0 means use suggested gas tip cap
 # minimum-gas-tip-cap: 0
-## minimum radius storage threshold
-# minimum-storage-radius: "0"
-## NAT exposed address
-# nat-addr: ""
-## suggester for target neighborhood
-# neighborhood-suggester: https://api.swarmscan.io/v1/network/neighborhoods/suggestion
-## ID of the Swarm network
-# network-id: "1"
-## P2P listen address
-# p2p-addr: :1634
-## enable P2P WebSocket transport
-# p2p-ws-enable: false
+## gas limit fallback when estimation fails for contract transactions (default 500000)
+# gas-limit-fallback: 500000
+## skips the gas estimate step for contract transactions
+# transaction-debug-mode: false
+## withdrawal target addresses
+# withdrawal-addresses-whitelist: []
+
+## ── Keys / identity ───────────────────────────────────────────────────────────
+## config file (default is $HOME/.bee.yaml)
+config: "./bee.yaml"
 ## password for decrypting keys
 # password: ""
 ## path to a file that contains password for decrypting keys
 password-file: "./password"
-## percentage below the peers payment threshold when we initiate settlement
-# payment-early-percent: 50
-## threshold in BZZ where you expect to get paid from your peers
-# payment-threshold: "13500000"
-## excess debt above payment threshold in percentages where you disconnect from your peer
-# payment-tolerance-percent: 25
-## postage stamp contract address
-# postage-stamp-address: ""
-## postage stamp contract start block number
-# postage-stamp-start-block: "0"
-## enable pprof mutex profile
-# pprof-mutex: false
-## enable pprof block profile
-# pprof-profile: false
-## price oracle contract address
-# price-oracle-address: ""
-## redistribution contract address
-# redistribution-address: ""
-## reserve capacity doubling
-# reserve-capacity-doubling: 0
-## ENS compatible API endpoint for a TLD and with contract address, can be repeated, format [tld:][contract-addr@]url
-# resolver-options: []
-## forces the node to resync postage contract data
-# resync: false
-## skip postage snapshot
-# skip-postage-snapshot: false
-## staking contract address
-# staking-address: ""
-## lru memory caching capacity in number of statestore entries
-# statestore-cache-capacity: "100000"
-## protect nodes from getting kicked out on bootnode
-# static-nodes: []
-## enable storage incentives feature
-# storage-incentives-enable: true
-## enable swap
-# swap-enable: false
-## swap factory addresses
-# swap-factory-address: ""
-## initial deposit if deploying a new chequebook
-# swap-initial-deposit: "0"
-## neighborhood to target in binary format (ex: 111111001) for mining the initial overlay
-# target-neighborhood: ""
+
+## ── Logging / tracing ─────────────────────────────────────────────────────────
+## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
+# verbosity: info
 ## enable tracing
 # tracing-enable: false
 ## endpoint to send tracing data
@@ -117,29 +155,15 @@ password-file: "./password"
 # tracing-port: ""
 ## service name identifier for tracing
 # tracing-service-name: bee
-## gas limit fallback when estimation fails for contract transactions (default 500000)
-# gas-limit-fallback: 500000
-## skips the gas estimate step for contract transactions
-# transaction-debug-mode: false
-## log verbosity level 0=silent, 1=error, 2=warn, 3=info, 4=debug, 5=trace
-# verbosity: info
+## enable pprof mutex profile
+# pprof-mutex: false
+## enable pprof block profile
+# pprof-profile: false
+
+## ── Miscellaneous ─────────────────────────────────────────────────────────────
 ## maximum node warmup duration; proceeds when stable or after this time
 # warmup-time: 5m0s
 ## send a welcome message string during handshakes
 # welcome-message: ""
-## withdrawal target addresses
-# withdrawal-addresses-whitelist: []
-## enable wss p2p connections (default: false)
-# p2p-wss-enable: false
-## wss address (default: :1635)
-# p2p-wss-addr: :1635
-## WSS NAT exposed address
-# nat-wss-addr: ""
-## autotls domain (default: libp2p.direct)
-# autotls-domain: ""
-## autotls registration endpoint (default: https://registration.libp2p.direct)
-# autotls-registration-endpoint: ""
-## autotls ca endpoint (default: https://acme-v02.api.letsencrypt.org/directory)
-# autotls-ca-endpoint: ""
 ## SIMD BMT hashing opt-in flag (only available on linux amd64)
 # use-simd-hashing: false
diff --git a/pkg/node/node.go b/pkg/node/node.go
index 0b3c6f12bd4..6bf1dcff364 100644
--- a/pkg/node/node.go
+++ b/pkg/node/node.go
@@ -127,6 +127,23 @@ type Bee struct {
 	ethClientCloser          func()
 }
 
+// NodeMode represents the operational mode of a Bee node as configured by the operator.
+type NodeMode string
+
+const (
+	FullMode       NodeMode = "full"
+	LightMode      NodeMode = "light"
+	UltraLightMode NodeMode = "ultra-light"
+)
+
+func (m NodeMode) IsValid() bool {
+	switch m {
+	case FullMode, LightMode, UltraLightMode:
+		return true
+	}
+	return false
+}
+
 type Options struct {
 	Addr                          string
 	AllowPrivateCIDRs             bool
@@ -160,7 +177,7 @@ type Options struct {
 	EnableWS                      bool
 	AutoTLSDomain                 string
 	AutoTLSRegistrationEndpoint   string
-	FullNodeMode                  bool
+	NodeMode                      NodeMode
 	GasLimitFallback              uint64
 	Logger                        log.Logger
 	MinimumGasTipCap              uint64
@@ -262,7 +279,7 @@ func NewBee(
 
 	// light nodes have zero warmup time for pull/pushsync protocols
 	warmupTime := o.WarmupTime
-	if !o.FullNodeMode {
+	if o.NodeMode != FullMode {
 		warmupTime = 0
 	}
 
@@ -288,7 +305,7 @@ func NewBee(
 		}
 	}(b)
 
-	if !o.FullNodeMode && o.ReserveCapacityDoubling != 0 {
+	if o.NodeMode != FullMode && o.ReserveCapacityDoubling != 0 {
 		return nil, fmt.Errorf("reserve capacity doubling is only allowed for full nodes")
 	}
 
@@ -393,14 +410,14 @@ func NewBee(
 		erc20Service      erc20.Service
 	)
 
-	chainEnabled := isChainEnabled(o, o.BlockchainRpcEndpoint, logger)
+	chainEnabled := isChainEnabled(o, logger)
 
 	if o.SwapEnable && !chainEnabled {
 		return nil, errors.New("swap is enabled but the chain backend is not; provide --blockchain-rpc-endpoint or disable swap")
 	}
 
-	if o.ChequebookVerification && (!o.FullNodeMode || !o.ChequebookEnable || !chainEnabled) {
-		return nil, fmt.Errorf("chequebook-verification requires full-node mode, chequebook-enable, and an enabled chain backend (full_node=%t, chequebook_enable=%t, chain_enabled=%t)", o.FullNodeMode, o.ChequebookEnable, chainEnabled)
+	if o.ChequebookVerification && (o.NodeMode != FullMode || !o.ChequebookEnable || !chainEnabled) {
+		return nil, fmt.Errorf("chequebook-verification requires full-node mode, chequebook-enable, and an enabled chain backend (full_node=%t, chequebook_enable=%t, chain_enabled=%t)", o.NodeMode == FullMode, o.ChequebookEnable, chainEnabled)
 	}
 
 	var batchStore postage.Storer = new(postage.NoOpBatchStore)
@@ -449,10 +466,13 @@ func NewBee(
 	b.transactionCloser = tracerCloser
 	b.transactionMonitorCloser = transactionMonitor
 
-	beeNodeMode := api.LightMode
-	if o.FullNodeMode {
+	var beeNodeMode api.BeeNodeMode
+	switch o.NodeMode {
+	case FullMode:
 		beeNodeMode = api.FullMode
-	} else if !chainEnabled {
+	case LightMode:
+		beeNodeMode = api.LightMode
+	default:
 		beeNodeMode = api.UltraLightMode
 	}
 
@@ -707,7 +727,7 @@ func NewBee(
 		AutoTLSRegistrationEndpoint: o.AutoTLSRegistrationEndpoint,
 		AutoTLSCAEndpoint:           o.AutoTLSCAEndpoint,
 		WelcomeMessage:              o.WelcomeMessage,
-		FullNode:                    o.FullNodeMode,
+		FullNode:                    o.NodeMode == FullMode,
 		Nonce:                       nonce,
 		AllowPrivateCIDRs:           o.AllowPrivateCIDRs,
 		Registry:                    registry,
@@ -850,7 +870,7 @@ func NewBee(
 		MinimumStorageRadius:      o.MinimumStorageRadius,
 	}
 
-	if o.FullNodeMode && !o.BootnodeMode {
+	if o.NodeMode == FullMode && !o.BootnodeMode {
 		// configure reserve only for full node
 		lo.ReserveCapacity = reserveCapacity
 		lo.ReserveWakeUpDuration = reserveWakeUpDuration
@@ -969,7 +989,7 @@ func NewBee(
 			}
 		}
 
-		if o.FullNodeMode {
+		if o.NodeMode == FullMode {
 			err = batchSvc.Start(ctx, postageSyncStart)
 			syncStatus.Store(true)
 			if err != nil {
@@ -994,7 +1014,7 @@ func NewBee(
 	minThreshold := big.NewInt(2 * refreshRate)
 	maxThreshold := big.NewInt(24 * refreshRate)
 
-	if !o.FullNodeMode {
+	if o.NodeMode != FullMode {
 		minThreshold = big.NewInt(2 * lightRefreshRate)
 	}
 
@@ -1027,7 +1047,7 @@ func NewBee(
 
 	var enforcedRefreshRate *big.Int
 
-	if o.FullNodeMode {
+	if o.NodeMode == FullMode {
 		enforcedRefreshRate = big.NewInt(refreshRate)
 	} else {
 		enforcedRefreshRate = big.NewInt(lightRefreshRate)
@@ -1122,7 +1142,7 @@ func NewBee(
 				if prev == uint32(swarm.MaxBins) {
 					close(initialRadiusC)
 				}
-				if !o.FullNodeMode { // light and ultra-light nodes do not have a reserve worker to set the radius.
+				if o.NodeMode != FullMode { // light and ultra-light nodes do not have a reserve worker to set the radius.
 					kad.SetStorageRadius(r)
 				}
 			case <-ctx.Done():
@@ -1149,7 +1169,7 @@ func NewBee(
 		}
 	}
 
-	pushSyncProtocol := pushsync.New(swarmAddress, networkID, nonce, p2ps, localStore, waitNetworkRFunc, kad, o.FullNodeMode && !o.BootnodeMode, pssService.TryUnwrap, gsocService.Handle, validStamp, logger, acc, pricer, signer, tracer, detector, uint8(shallowReceiptTolerance))
+	pushSyncProtocol := pushsync.New(swarmAddress, networkID, nonce, p2ps, localStore, waitNetworkRFunc, kad, o.NodeMode == FullMode && !o.BootnodeMode, pssService.TryUnwrap, gsocService.Handle, validStamp, logger, acc, pricer, signer, tracer, detector, uint8(shallowReceiptTolerance))
 	b.pushSyncCloser = pushSyncProtocol
 
 	// set the pushSyncer in the PSS
@@ -1172,7 +1192,7 @@ func NewBee(
 	pushSyncProtocolSpec := pushSyncProtocol.Protocol()
 	pullSyncProtocolSpec := pullSyncProtocol.Protocol()
 
-	if o.FullNodeMode && !o.BootnodeMode {
+	if o.NodeMode == FullMode && !o.BootnodeMode {
 		logger.Info("starting in full mode")
 	} else {
 		if chainEnabled {
@@ -1254,7 +1274,7 @@ func NewBee(
 		agent         *storageincentives.Agent
 	)
 
-	if o.FullNodeMode && !o.BootnodeMode {
+	if o.NodeMode == FullMode && !o.BootnodeMode {
 		pullerService = puller.New(swarmAddress, stateStore, kad, localStore, pullSyncProtocol, p2ps, logger, puller.Options{})
 		b.pullerCloser = pullerService
 
@@ -1574,21 +1594,13 @@ func (b *Bee) Shutdown() error {
 
 var ErrShutdownInProgress = errors.New("shutdown in progress")
 
-func isChainEnabled(o *Options, swapEndpoint string, logger log.Logger) bool {
-	chainDisabled := swapEndpoint == ""
-	lightMode := !o.FullNodeMode
-
-	if lightMode && chainDisabled {
-		logger.Info("chain backend disabled - starting in ultra-light mode",
-			"full_node_mode", o.FullNodeMode,
-			"blockchain-rpc-endpoint", swapEndpoint)
+func isChainEnabled(o *Options, logger log.Logger) bool {
+	if o.NodeMode == UltraLightMode {
+		logger.Info("chain backend disabled - starting in ultra-light mode")
 		return false
 	}
-
-	logger.Info("chain backend enabled - blockchain functionality available",
-		"full_node_mode", o.FullNodeMode,
-		"blockchain-rpc-endpoint", swapEndpoint)
-	return true // all other modes operate require chain enabled
+	logger.Info("chain backend enabled - blockchain functionality available", "node_mode", o.NodeMode)
+	return true
 }
 
 func validatePublicAddress(addr string) error {