diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index c59e4d9a..bea00e7a 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -182,13 +182,12 @@ in
       example = true;
       description = ''
         Open `httpPort` + `sshPort` in the host firewall. Off by
-        default (secure-by-default): the forge is reachable from the
-        host + every agent container via `localhost` either way
-        (shared netns), so the firewall opens only matter for access
-        from outside the host. Flip to `true` when you want the
-        operator's browser / external git clients to hit the forge
-        directly. (The container shares host netns, so this is the
-        only firewall layer that matters.)
+        default (secure-by-default): agent containers reach the forge
+        at `forge.<domain>` via the gateway (not directly), and the
+        host reaches it on loopback — so the firewall opens only
+        matter for access from outside the host. Flip to `true` when
+        you want the operator's browser or external git clients to
+        hit the forge directly.
 
         **Breaking change**: this used to default to `true`. If you
         relied on the old default for external reach, add