diff --git a/docs/scheduler/ci.md b/docs/scheduler/ci.md
index 74196cd5..983f166e 100644
--- a/docs/scheduler/ci.md
+++ b/docs/scheduler/ci.md
@@ -186,7 +186,7 @@ nspawn containers can't create user-namespaces, so the module sets `nix.settings
 
 A malicious `default.nix` or build script in a PR can therefore:
 
-- **Make arbitrary network requests** to any address reachable from the container. The container runs in its own netns behind the hive bridge, so it reaches the forge only through the gateway (`http://<forge.domain>`, public/read endpoints — no admin credentials) and **can't** reach host-loopback services: the unauthenticated core dashboard at `127.0.0.1:7000` and the raw forge port are off-limits (bridge→127.0.0.0/8 is dropped).
+- **Make arbitrary network requests** to any address reachable from the container. The container runs in its own netns behind the hive bridge, so it reaches the forge only through the gateway (`http://<forge.domain>`, public/read endpoints — no admin credentials) and **can't** reach host-loopback services: the unauthenticated core dashboard at `127.0.0.1:7000` and the raw forge port are off-limits (a firewall rule drops bridge→127.0.0.0/8 traffic).
 - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials.
 
 The core admin token (`forge-core-token`) **isn't** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls.