diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 6674d4d..88f36b4 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -8,6 +8,10 @@
 # healthcheck. All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
 # The checklist app's "nas" runner on Chronicles-NA is not involved.
 #
+# That runner and its job containers use Docker host networking: containers on bridge
+# networks on Chronicles-AB have no outbound NAT (no DNS, no internet), which made the first
+# run fail while fetching actions/checkout.
+#
 # ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
 #   1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
 #      public half to /home/ubuntu/.ssh/authorized_keys on the box.
diff --git a/README.md b/README.md
index 8e9c176..ece620f 100644
--- a/README.md
+++ b/README.md
@@ -130,7 +130,9 @@ to deploy to a host other than `boards-aws`.
 so AWS can't pull from it. Instead a runner inside the network runs the same `deploy.sh` and
 pushes to the box over SSH. That runner is a container on Chronicles-AB (the NAS that hosts
 Gitea), in `/volume2/docker/gitea-runner-boards`, registered for this repo only with the label
-`aws-deploy`. The checklist app's `nas` runner on Chronicles-NA is separate and untouched. The workflow
+`aws-deploy`. The checklist app's `nas` runner on Chronicles-NA is separate and untouched. The
+runner and its job containers use Docker host networking, because containers on bridge
+networks on that NAS have no outbound access at all (no DNS, no internet). The workflow
 (`.gitea/workflows/deploy.yml`) runs on every push to `main` that touches `server/` or
 `deploy/aws/`, or by hand from the Gitea Actions tab. One-time setup: