diff --git a/docs/networking/network.md b/docs/networking/network.md
index 80ae48e0..f2f828c3 100644
--- a/docs/networking/network.md
+++ b/docs/networking/network.md
@@ -164,7 +164,7 @@ agent containers.
   UI proxies, and any other HTTP services.
 
 The **host** firewall is the only firewall. The swarm service
-containers that share the host netns (forge, matrix, authelia, bao, the
+containers that share the host netns (forge, authelia, bao, the
 metrics and log stores) run with `networking.firewall.enable = false`
 (`nix/container-modules/swarm-container.nix`): a NixOS firewall inside a
 shared-netns container runs against the _host_ ruleset — at container
@@ -172,7 +172,7 @@ boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them
 from the container's (empty) port list, and deletes the host's
 `nixos-nat-*` chains without recreating them, silently wiping the
 bridge holes above plus the agents' NAT. Private-netns containers
-(agents, swarm-ci-runner) may keep their own firewall — it's scoped to their
+(every container with `privateNetwork = true`: agents and the service containers on the bridge) keep their own firewall — it's scoped to their
 namespace.
 
 ### Reaching host services (`exposeHostPorts`)
diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index 143aaeda..803a259a 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -18,7 +18,7 @@ use reqwest::StatusCode;
 ///
 /// `None` means **this hive has no homeserver to provision against** and
 /// every matrix path no-ops — see [`is_present`]. There is deliberately no
-/// fallback: `localhost:8008` is right only when the homeserver happens to
+/// fallback: a loopback default is right only when the homeserver happens to
 /// share this daemon's netns, and an address baked into the binary is one
 /// that builds fine and then talks to the wrong machine. The nix module
 /// defaults it to `https://` on the homeserver's gateway vhost, on every
diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 463dd855..082aa2fb 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -492,7 +492,7 @@ let
     mv ${lib.escapeShellArg "${clientsFile}.tmp"} ${lib.escapeShellArg clientsFile}
   '';
 
-  # Shared host netns, like the forge and matrix containers: the
+  # Shared host netns, like the forge container: the
   # gateway reaches authelia at 127.0.0.1:<port>.
   privateNetwork = false;
 in