diff --git a/scripts/codeman-web.service b/scripts/codeman-web.service
index 7a401609..334922eb 100644
--- a/scripts/codeman-web.service
+++ b/scripts/codeman-web.service
@@ -12,10 +12,14 @@ KillMode=process
 Environment=NODE_ENV=production
 Environment=HOME=/home/arkon
 Environment=NODE_COMPILE_CACHE=/home/arkon/.codeman/compile-cache
-# Make the gesture-control overlay AVAILABLE (CSP widening + /gesture/ assets +
-# window.__codemanGestureAvailable). The actual on/off stays the per-user
-# `gestureControlEnabled` toggle in App Settings → Display → Input (default OFF).
+# Loopback bind (default, no --host) + no password: safe out of the box. Hooks
+# reach 127.0.0.1, and `tailscale serve` fronts it on the tailnet only (real
+# cert, no LAN exposure, no app login). To expose on the LAN instead, add
+# Environment=CODEMAN_HOST=0.0.0.0 + Environment=CODEMAN_PASSWORD=... .
+# See docs/security-architecture.md.
 Environment=CODEMAN_GESTURE=1
+# ^ Makes the gesture-control overlay AVAILABLE (CSP widening + /gesture/ assets);
+#   the actual on/off stays the per-user App Settings toggle (default OFF).
 
 # Logging
 StandardOutput=journal