diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 1614f5c5..df43b867 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -587,6 +587,17 @@ in
               # (where nginx is reachable from container netns once
               # #14 lands; today it's the host loopback alias and
               # works in either shape).
+              #
+              # The forge / matrix entries are redundant in the
+              # common case where `forge.domain` /
+              # `matrix.gatewayHost` are sub-domains of
+              # `hyperhive.domain` — dnsmasq's `/<domain>/` rule
+              # already matches sub-domains (argus 🟡 on #845).
+              # Kept explicit because operators can override either
+              # to a cross-domain hostname (e.g.
+              # `forge.domain = "git.example.com"`); listing them
+              # explicitly keeps that case routed without needing
+              # an extra config block.
               address = [
                 "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
               ]