diff --git a/docs/gotchas.md b/docs/gotchas.md
index 22351306..4c106d3d 100644
--- a/docs/gotchas.md
+++ b/docs/gotchas.md
@@ -30,12 +30,9 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+.
 
 …in the `.conf`. The start script's `if HOST_ADDRESS set →
 --network-veth` branch then forces a private netns — silently fatal
-for our web UIs (the bind is invisible from the host). Every agent
-container runs isolated: `hive-priv`'s `write_nspawn_flags` writes
-`PRIVATE_NETWORK=1` plus a veth pair onto the host bridge, `HOST_ADDRESS`
-set to the bridge gateway IP (so `nixos-container`'s in-container init
-installs a default route before the DHCP lease arrives), rest left for
-DHCP.
+for our web UIs (the bind is invisible from the host). We
+force-clear `HOST_ADDRESS` / `LOCAL_ADDRESS` / `HOST_ADDRESS6` /
+`LOCAL_ADDRESS6` / `HOST_BRIDGE` and set `PRIVATE_NETWORK=0`.
 
 ### systemd service PATH ≠ host PATH
 
diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 4511050a..5038d839 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -2578,6 +2578,12 @@ fn validate_bind_path(path: &str) -> Result<()> {
     Ok(())
 }
 
+/// Update `/etc/nixos-containers/<container>.conf`: strips network-isolation
+/// vars (`PRIVATE_NETWORK`, `HOST_ADDRESS*`, `LOCAL_ADDRESS*`, `HOST_BRIDGE`,
+/// Update `/etc/nixos-containers/<container>.conf`: strip old network vars,
+/// write network isolation settings, then append `EXTRA_NSPAWN_FLAGS`.
+/// When `isolation` is `Some`, writes `PRIVATE_NETWORK=1` + veth wiring;
+/// when `None`, writes `PRIVATE_NETWORK=0`.
 /// `--tmpfs=<mount>/.git` for every bound git repo, hiding its metadata
 /// from inside the container.
 ///
@@ -2607,12 +2613,6 @@ fn git_overlay_flags(binds: &[BindMount]) -> Vec<String> {
         .collect()
 }
 
-/// Update `/etc/nixos-containers/<container>.conf`: strip old network vars
-/// (`PRIVATE_NETWORK`, `HOST_ADDRESS*`, `LOCAL_ADDRESS*`, `HOST_BRIDGE`),
-/// write the current network-isolation settings, then append
-/// `EXTRA_NSPAWN_FLAGS`. When `isolation` is `Some`, writes
-/// `PRIVATE_NETWORK=1` + veth wiring; when `None`, writes
-/// `PRIVATE_NETWORK=0`.
 fn write_nspawn_flags(
     container: &str,
     binds: &[BindMount],