diff --git a/hive-sh4re/src/priv_proto.rs b/hive-sh4re/src/priv_proto.rs
index 3638084c..288d53c1 100644
--- a/hive-sh4re/src/priv_proto.rs
+++ b/hive-sh4re/src/priv_proto.rs
@@ -182,8 +182,13 @@ pub enum PrivRequest {
     /// Run `systemctl daemon-reload`.
     DaemonReload,
 
-    /// Reload nginx inside the `hive-gateway` container via
-    /// `systemd-run --machine=hive-gateway nginx -s reload`.
+    /// Synchronise the nginx unit inside the `hive-gateway` container.
+    /// hive-priv queries `ActiveState` and dispatches:
+    /// - `active`  → `systemctl reload nginx` (SIGHUP, zero-downtime)
+    /// - `failed`  → `systemctl reset-failed nginx` + `systemctl start nginx`
+    /// - otherwise → `systemctl start nginx`
+    /// Requires root: `--machine=hive-gateway` enters the container
+    /// namespace via the machine bus (forbidden for unprivileged users).
     ReloadGatewayNginx,
 
     // --- Socket dir ownership ---