diff --git a/garage/templates/garage.configmap.yaml b/garage/templates/garage.configmap.yaml
index 5f60c28..362cf02 100644
--- a/garage/templates/garage.configmap.yaml
+++ b/garage/templates/garage.configmap.yaml
@@ -144,12 +144,24 @@ data:
     # "0.0.0.0" on an IPv4-only cluster, or garage.adminBindAddress to "[::]"
     # on an IPv6-only one.
     #
-    # NO admin_token IS SET, so every authenticated admin endpoint is closed.
-    # That is not an omission: /health, the one endpoint the probes use, is
-    # explicitly token-free (@special in the admin router), and nothing in this
-    # deployment calls the authenticated API - the CLI inside the pod talks RPC,
-    # not HTTP. Adding a token would mean a fifth vault field guarding nothing
-    # that is in use. If you need it, it is admin_token_file / the
+    # NO admin_token IS SET, and that is not an omission: /health, the one
+    # endpoint the probes use, is explicitly token-free (@special in the admin
+    # router), and nothing in this deployment calls the authenticated API - the
+    # CLI inside the pod talks RPC, not HTTP. A token here would be a fifth
+    # vault field guarding nothing that is in use.
+    #
+    # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no
+    # token" reads like "nothing is open":
+    #   /health   open, by design, and the probes depend on it
+    #   /metrics  OPEN TOO - metrics_require_token defaults to false, so with
+    #             no metrics_token the endpoint needs no authentication. That
+    #             is internal metrics on a ClusterIP port; set
+    #             metrics_require_token = true plus a token to close it.
+    #   everything else  401/403 until a token exists. Note that a config
+    #             token is not the only way to get one: Garage 2.x also keeps
+    #             admin tokens in the cluster ("garage admin-token create"),
+    #             and those work without any entry in this file.
+    # If you do want a config token, it is admin_token_file / the
     # GARAGE_ADMIN_TOKEN environment variable - and the file form carries the
     # same permission trap as rpc_secret_file (see values.yaml).
     api_bind_addr = "{{ $settings.adminBindAddress }}:{{ $settings.ports.admin | int64 }}"
diff --git a/garage/templates/garage.service.yaml b/garage/templates/garage.service.yaml
index d08b78e..2d6620b 100644
--- a/garage/templates/garage.service.yaml
+++ b/garage/templates/garage.service.yaml
@@ -17,10 +17,12 @@ spec:
       port: {{ $settings.ports.s3 | int64 }}
       targetPort: s3
       name: s3
-    # The admin endpoint. With no admin_token configured (see the ConfigMap)
-    # this serves exactly two things without authentication, /health and
-    # /metrics, and answers everything else with 401 - so it is a monitoring
-    # surface, not a management one.
+    # The admin endpoint. With this chart's configuration it serves exactly two
+    # things without authentication - /health (token-free by design) and
+    # /metrics (because metrics_require_token defaults to false) - and answers
+    # everything else with 401/403 until an admin token exists, whether from
+    # the config or from "garage admin-token create". So it is a monitoring
+    # surface rather than a management one, and it is a ClusterIP port.
     - protocol: TCP
       port: {{ $settings.ports.admin | int64 }}
       targetPort: admin