diff --git a/nix/host-modules/hive-egress.nix b/nix/host-modules/hive-egress.nix
index aa8cd91f6..1a83942ad 100644
--- a/nix/host-modules/hive-egress.nix
+++ b/nix/host-modules/hive-egress.nix
@@ -354,7 +354,9 @@ in
         `hive-egress-spoof `, rate limited per port. A packet the per-port limit
         cannot log gets a line with the prefix `hive-egress-spoof-unmetered `
         from a limit shared by all ports. A container sending from its leased
-        address is never affected, so nothing legitimate breaks.
+        address is unaffected while its (MAC, IP) pair is in the lease set; a
+        lost pair, as after a host suspend/resume, cuts the container off until
+        it leases again.
       - `log` (the default): the same lines and counters, and the frame goes
         through. For finding out why a legitimate container is refused on a
         live hive. It is the default because the lease set does not yet survive