diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index dd0310af..bdb37df7 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -949,7 +949,6 @@ in
           # container. Listens on the bridge interface from
           # `services.hyperhive.network`; authoritative for the hive
           # domain + sub-domains, forwards everything else upstream.
-          # No-op when `network.enable = false`.
           services.dnsmasq = lib.mkIf networkCfg.enable {
             enable = true;
             # Don't substitute the container's /etc/resolv.conf —
diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix
index 8c66f8e8..0dcca3d8 100644
--- a/nix/modules/hive-network.nix
+++ b/nix/modules/hive-network.nix
@@ -8,9 +8,8 @@ let
 in
 {
   # Hive-internal network — host-side bridge + per-agent DNS resolver.
-  # Containers stay on shared host netns at v1; this module stands the
-  # bridge + resolver up so the endpoint is in place before network
-  # isolation flips containers to private netns. Full design: docs/network.md.
+  # Always active when hyperhive is enabled: agent containers run in
+  # private netns behind the bridge. Full design: docs/network.md.
 
   options.services.hyperhive.network = {
     enable = lib.mkOption {