diff --git a/docs/network.md b/docs/network.md
index f538bf95..39f24c1e 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -245,12 +245,11 @@ wiring is runtime:
   It is ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
   `tea-login` so the resolver is correct before the first DNS lookup.
 
-**Why isolation is safe**: all hive-c0re communication goes
-through unix domain sockets (`/run/hive/mcp.sock` for agent requests,
-`/run/hive/priv.sock` for privileged ops).
-These are bind-mounted into containers via the nspawn conf. UDS paths
-traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not
-affect them.
+**Why isolation is safe**: hive-c0re's control-plane sockets are unix
+domain sockets bind-mounted into containers, not network listeners — see
+the *Control plane (no network)* bullet under [Network
+map](#network-map) above. `PRIVATE_NETWORK=1` has no effect on a path
+that never touches the network stack.
 
 The nix side also enables IP forwarding + NAT (agents reach the internet
 through the host) and drops bridge-subnet → loopback traffic (defence-in-depth