diff --git a/docs/networking/gateway.md b/docs/networking/gateway.md
index 7fe765e1..5e175e1a 100644
--- a/docs/networking/gateway.md
+++ b/docs/networking/gateway.md
@@ -1,6 +1,6 @@
 # hive-gateway
 
-Single nginx in front of every hyperhive web surface. Runs on the **host**, next to hive-c0re, rather than in its own container: it shares the host netns anyway (see [Vhost map](#vhost-map) below), so containerizing it would buy no network isolation while costing a resolv.conf sync, a machine-bus reload, and three bind mounts. System-config (not meta-flake managed). Configured via `services.hyperhive.gateway.*` + per-subsystem opt-in flags in `services.hyperhive.{forge,matrix,...}`. `gateway.enable` and `gateway.dns.enable` are asserted by the modules that need them, so a host serving a vhost or resolving hive names gets them without an opt-in.
+This host's nginx fronts the hyperhive web surfaces running on it — next to hive-c0re, not in its own container: it shares the host netns anyway (see [Vhost map](#vhost-map) below), so containerizing it would buy no network isolation while costing a resolv.conf sync, a machine-bus reload, and three bind mounts. System-config (not meta-flake managed). Configured via `services.hyperhive.gateway.*` + per-subsystem opt-in flags in `services.hyperhive.{forge,matrix,...}`. `gateway.enable` and `gateway.dns.enable` are asserted by the modules that need them, so a host serving a vhost or resolving hive names gets them without an opt-in.
 
 ## Vhost map
 
diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix
index d0e74831..f3ff3863 100644
--- a/nix/host-modules/hive-gateway/default.nix
+++ b/nix/host-modules/hive-gateway/default.nix
@@ -1,7 +1,7 @@
-# Single nginx in front of every hyperhive web surface — dashboard,
+# This host's nginx fronts the hyperhive web surfaces on it — dashboard,
 # per-agent UIs (sub-path), forge + matrix (sub-domain), .well-known
-# delegations — plus the hive-internal dnsmasq resolver. Both run on the
-# HOST, next to hive-c0re: nginx binds the host's :80/:443 and dnsmasq
+# delegations — plus the hive-internal dnsmasq resolver. Both run on
+# this host, next to hive-c0re: nginx binds :80/:443 and dnsmasq
 # answers on the hive bridge, so neither can be confined to a network
 # namespace of its own.
 # Full vhost map + discovery flow + design rationale in