diff --git a/docs/network.md b/docs/network.md
index e87e5802..7a14be0d 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -121,12 +121,12 @@ address arithmetic.
 ### What the Rust side does
 
 `hive-c0re` reads `HIVE_NETWORK_ISOLATION` and passes
-`PRIVATE_NETWORK=1`, `LOCAL_ADDRESS=<deterministic-ip>`,
-`HOST_ADDRESS=<bridge-ip>`, and `HOST_BRIDGE=<bridgeName>` via
-`lifecycle::set_nspawn_flags` when creating or updating containers. Each
-agent gets a deterministic IP derived from its name so the address is
-reproducible across destroy/recreate. This applies uniformly to all
-containers — no special case.
+`PRIVATE_NETWORK=1`, `LOCAL_ADDRESS=` (empty), `HOST_ADDRESS=<bridge-ip>`,
+and `HOST_BRIDGE=<bridgeName>` via `lifecycle::set_nspawn_flags` when
+creating or updating containers. `LOCAL_ADDRESS` is left empty so the
+container's dhcpcd acquires an address from the bridge dnsmasq pool
+(`networking.useDHCP = true` in `harness-base.nix`). This applies uniformly
+to all containers — agents and service containers alike.
 
 `HOST_ADDRESS` is the bridge gateway IP (the address part of
 `HIVE_NETWORK_SUBNET`, via `lifecycle::bridge_gateway_ip` — taken verbatim
diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index f9805c8a..15251720 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -410,9 +410,9 @@ in
           # affect traffic destined for the bridge IP itself.
           networking.nameservers = [ networkCfg.bridgeIp ];
           # Bridge-attached via privateNetwork=true + hostBridge. The
-          # gateway's dnsmasq now serves a DHCP pool for service containers
-          # (see dhcp-range in hive-gateway.nix). hive-ci gets its address
-          # from that pool; no static address needed.
+          # gateway's dnsmasq serves a DHCP pool covering all usable bridge
+          # addresses (see dhcp-range in hive-gateway.nix) — agents and
+          # service containers alike receive IPs dynamically.
           networking.interfaces.eth0.useDHCP = true;
 
           # nspawn containers can't create user-namespaces, so nix