diff --git a/docs/gateway.md b/docs/gateway.md
index 09d04c4d..53308000 100644
--- a/docs/gateway.md
+++ b/docs/gateway.md
@@ -118,7 +118,12 @@ agent's nspawn doesn't have DNS for the external hostname.
 
 Private Forgejo wrapped in a nixos-container (`hive-forge`, not
 `h-*` — keeps c0re's lifecycle scanner out of the picture; the
-operator manages it via the standard `nixos-container` CLI).
+operator manages it via the standard `nixos-container` CLI). The
+container also keeps hive-forge from fighting any `services.forgejo`
+the operator already runs on the host — separate systemd namespace,
+separate state dir, separate port unless the operator deliberately
+collides.
+
 Container shares the host network namespace
 (`privateNetwork = false`) so agents reach the forge at
 `http://localhost:<httpPort>` without extra plumbing — nixos-container