diff --git a/docs/matrix.md b/docs/matrix.md
index 7e3dd972..65c89276 100644
--- a/docs/matrix.md
+++ b/docs/matrix.md
@@ -17,10 +17,9 @@ Same shape as [`gateway.md::hive-forge container shape`](gateway.md):
   operator already runs on the host — separate systemd namespace,
   separate state dir.
 - Container shares the host network namespace
-  (`privateNetwork = false`) so agents reach tuwunel at
-  `http://localhost:<httpPort>` without extra plumbing — the
-  nixos-container is here for state + systemd-unit isolation, not
-  network isolation.
+  (`privateNetwork = false`) for state + systemd-unit isolation. Agents
+  reach the homeserver at `matrix.<domain>` via the gateway (agents
+  run in private netns and can't access host loopback directly).
 - Persistent state at
   `/var/lib/nixos-containers/hive-matrix/var/lib/matrix-tuwunel/`
   survives container restart / host reboot. To wipe, destroy the
@@ -52,9 +51,9 @@ sub-domain from the user-facing identifier.
 
 ## Default-closed firewall
 
-`openFirewall` defaults to `false` (secure-by-default): the
-homeserver is reachable from the host + every agent container via
-loopback either way (shared netns), so the firewall hole only
+`openFirewall` defaults to `false` (secure-by-default): the host
+reaches the homeserver on loopback, and agent containers reach it
+at `matrix.<domain>` via the gateway — so the firewall hole only
 matters for access from *outside* the host. Flip to `true` when
 announcing the homeserver to other hives or when an external matrix
 client needs to reach the client-server API directly.
diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index bea00e7a..8178e196 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -56,8 +56,8 @@ let
 in
 {
   # Private Forgejo in a `hive-forge` nixos-container, shared host
-  # netns so agents reach it on loopback. State at
-  # `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/` survives
+  # netns. Agents reach it at `forge.<domain>` via the gateway. State
+  # at `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/` survives
   # restart. See `docs/gateway.md::hive-forge container shape`.
 
   # The internal forge is mandatory — it's the canonical store for the
diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index ed120fac..b8a7378a 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -173,12 +173,12 @@ in
       example = true;
       description = ''
         Open `httpPort` in the host firewall. Off by default
-        (secure-by-default): the homeserver is reachable from the
-        host + every agent container via `localhost` either way
-        (shared netns), so the firewall open only matters for access
-        from outside the host. Flip to `true` when announcing the
-        homeserver to other hives or when an external matrix client
-        needs to reach the client-server API directly.
+        (secure-by-default): the host reaches the homeserver on
+        loopback, and agent containers reach it at `matrix.<domain>`
+        via the gateway — so the firewall open only matters for
+        access from outside the host. Flip to `true` when announcing
+        the homeserver to other hives or when an external matrix
+        client needs to reach the client-server API directly.
 
         **Breaking change**: this used to default to `true`. If you
         relied on the old default for external reach, add