diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index bf44cf7a..57be923e 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -2797,8 +2797,8 @@ fn write_nspawn_flags(
     // anyway). The `hyperhive-isolated-dns` oneshot in harness-base.nix
     // rewrites resolv.conf to point at the bridge resolver, but only when
     // this marker exists; it carries the gateway IP so the container
-    // doesn't have to re-derive it. Written on isolate, removed otherwise,
-    // so the same shared container toplevel behaves correctly in both modes.
+    // doesn't have to re-derive it. Always written — every container is
+    // isolated, so there is no mode in which the marker should be absent.
     write_bridge_dns_marker(container, isolation)?;
     Ok(())
 }