diff --git a/docs/gotchas.md b/docs/gotchas.md
index 275919f1..9642bc4b 100644
--- a/docs/gotchas.md
+++ b/docs/gotchas.md
@@ -49,9 +49,11 @@ touches the conf file, and which way it writes them depends on
   `HOST_ADDRESS6` / `LOCAL_ADDRESS6` / `HOST_BRIDGE` and
   `PRIVATE_NETWORK=0` — only fires when `HIVE_NETWORK_ISOLATION` isn't
   `"1"` at all (env var unset) or the bridge subnet fails to parse
-  (`bridge_gateway_ip` returns `None`, logged as a warning). Not a
-  supported alternate mode any more, just what the code falls back to
-  outside the one path every host actually takes.
+  (`bridge_gateway_ip` returns `None`, logged as a warning). This isn't
+  a supported alternate mode, it's residual code from before isolation
+  was mandatory — see hyperhive#3725 for removing it (and deciding
+  what an unset env var / unparseable subnet should do instead of
+  silently degrading to non-isolated).
 
 ### systemd service PATH ≠ host PATH