diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index dab02e3d..4793d5ae 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -13,9 +13,11 @@ let
 
   # DHCP pool for bridge-attached service containers (hive-ci, etc.).
   # Occupies the last dhcpPoolSize usable addresses of the subnet
-  # (e.g. .241-.254 on a /24). Agent containers use deterministic static
+  # (e.g. .241-.254 on a /24). Agent containers use hash-derived static
   # IPs (lifecycle::agent_network_ip) and are excluded from this range
-  # by a remap in the Rust code.
+  # by subtracting dhcpPoolSize from the usable count before hashing
+  # (agent_slots = usable - dhcpPoolSize), so agents only ever land in
+  # [.2, .(usable-dhcpPoolSize+1)] by construction.
   #
   # Single source of truth: `nix/dhcp-pool-size` (one integer).
   # Rust reads it at compile time via `include_bytes!` in lifecycle/mod.rs.
@@ -1035,7 +1037,8 @@ in
               # DHCP pool for bridge-attached service containers (hive-ci, etc.).
               # Range is computed from the bridgeIp/bridgePrefixLength at eval
               # time; the last dhcpPoolSize usable host addresses are reserved.
-              # Agent containers are excluded by agent_network_ip's DHCP remap.
+              # Agent containers hash into agent_slots = usable - dhcpPoolSize
+              # so they never land here (excluded by construction, not remapping).
               dhcp-range = "${dhcpStart},${dhcpEnd},1h";
               dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
             };