diff --git a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
index 021f962a..a2f541b6 100644
--- a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml
@@ -160,6 +160,12 @@ spec:
 ---
 # In-cluster + DNS for every pod except terminus (terminus-egress is its
 # allowlist; selecting it here would widen it to all of `cluster`).
+#
+# trmnl-renderer's Chromium calls clients2.google.com:80,
+# update.googleapis.com:443 and accounts.google.com:443; these drops are
+# expected and harmless. The launch flags are fixed in upstream
+# trmnl-ha/ha-trmnl/screenshot.ts (PUPPETEER_ARGS, no override) and lack
+# --disable-background-networking.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata: