diff --git a/opentofu/unifi_nat_hairpin.tf b/opentofu/unifi_nat_hairpin.tf
index ea828e67..8e55d85f 100644
--- a/opentofu/unifi_nat_hairpin.tf
+++ b/opentofu/unifi_nat_hairpin.tf
@@ -68,13 +68,14 @@ locals {
   # idx is a static per-network slot for rule_index derivation — never
   # reuse a freed idx for a new network.
   #
-  # Deliberately absent: (40) Server idx=4, (42) Ingress idx=5, and
-  # (49) k8s Ceph idx=6. The cluster nodes have interfaces on those VLANs,
-  # so a DNATed flow's reply would go directly over the shared L2 and
-  # bypass the UDM's conntrack (asymmetric, connection drops) — and
-  # clients there are the nodes themselves, whose DNS chain (CoreDNS ->
-  # k8s_gateway) already resolves the public names in-cluster. Their idx
-  # slots stay reserved.
+  # Deliberately absent: (40) Server idx=4, (49) k8s Ceph idx=6,
+  # (46) k8s Node, (47) k8s Ingress and (48) k8s Pod. The cluster nodes
+  # have interfaces on those VLANs (mgmt0, node0, ingress0, pod0), so a
+  # DNATed flow's reply would go directly over the shared L2 and bypass
+  # the UDM's conntrack (asymmetric, connection drops) — and clients there
+  # are the nodes themselves, whose DNS chain (CoreDNS -> k8s_gateway)
+  # already resolves the public names in-cluster. idx=5 stays reserved
+  # (its network, (42) Ingress, no longer exists).
   hairpin_networks = {
     "Default"              = { id = "5d4fba77ce63ee614841d53d", idx = 0 }
     "(10) Management"      = { id = "600334abf9ee0c059da6be8f", idx = 1 }