diff --git a/CLAUDE.md b/CLAUDE.md
index cf999a3..a4c7c9a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -86,6 +86,11 @@ Testing sign-in from Tower itself proves nothing about the tunnel: Tower's own r
 published port as `192.168.1.130`, and Caddy rightly strips their `Cf-Access-*`. Send them from a
 container on another network, as cloudflared's are (#209).
 
+The three containers resolve names through Cloudflare (`dns: [1.1.1.1, 1.0.0.1]` in the compose
+file), not the router: the LAN's DNS is NextDNS, which answers for a domain it filters with its own
+block page, and ipx then logged a feed as failing with `invalid peer certificate: UnknownIssuer`
+(tomrenner.com, 2026-10-17). Docker's own DNS still answers for the services' names first.
+
 **Name the service.** A bare `up -d` recreates every container in the project, which once the
 split lands means the frontend and directory too. Run `pull` before `up`, because `up` reuses whatever `latest` the host already has.