diff --git a/deploy/forgejo/caddy-git.conf b/deploy/forgejo/caddy-git.conf
index a7cc17c..8118682 100644
--- a/deploy/forgejo/caddy-git.conf
+++ b/deploy/forgejo/caddy-git.conf
@@ -1,8 +1,12 @@
-# Append this block to /etc/caddy/Caddyfile on beta (the box this stack's
-# `forgejo` service is pinned to — see docker-stack.yml). Reuses beta's
-# existing Caddy instead of a second reverse proxy/ACME flow: Forgejo
-# publishes its web UI to 127.0.0.1:3080 only (host-local), and this block is
-# the only thing that ever talks to it.
+# Only the block below (from "git.thermograph.org {") goes into the live
+# Caddyfile — append just that part, not this instructional header, or it
+# ends up as a confusing orphaned comment in production config with no
+# surrounding context (docker-stack.yml isn't visible from there).
+#
+# Target: /etc/caddy/Caddyfile on beta (the box `forgejo` is pinned to — see
+# docker-stack.yml). Reuses beta's existing Caddy instead of a second reverse
+# proxy/ACME flow: Forgejo publishes its web UI to 127.0.0.1:3080 only
+# (host-local), and this block is the only thing that ever talks to it.
 #
 # Registry exposure (hazard #15, see docker-stack.yml's header comment):
 # git.thermograph.org/v2/* is the built-in OCI registry API. It's blocked
@@ -11,8 +15,10 @@
 # else (web UI, git-over-HTTP, PR pages) stays public like the rest of the
 # site.
 #
-# Update FORGEJO_DOMAIN below to match whatever domain you actually pointed
-# at beta's IP if it's not git.thermograph.org.
+# Update the domain below to match whatever you actually pointed at beta's
+# IP, if not git.thermograph.org.
+
+# --- copy from here down into /etc/caddy/Caddyfile ---
 
 git.thermograph.org {
 	encode zstd gzip