diff --git a/gotenberg/values.yaml b/gotenberg/values.yaml
index 706fb5f..9794e8b 100644
--- a/gotenberg/values.yaml
+++ b/gotenberg/values.yaml
@@ -106,10 +106,10 @@ networkPolicy:
   # this service fetch arbitrary URLs through it - and 3000 is the probe port,
   # so the whole cluster can POST to it by default. The cost is the
   # remote-asset half of HTML conversion: a converted page keeps its inline
-  # content and silently loses images it would have fetched. That is a degraded
-  # PDF, not a dead pod, which is exactly why it is written down here. A
-  # deployment that needs remote assets sets egress.extraPorts: [80, 443]
-  # knowingly.
+  # content and silently loses the images it would have FETCHED. That is a
+  # degraded PDF, not a dead pod, which is exactly why it is written down here.
+  # A deployment that needs those images sets egress.remoteAssets: true below -
+  # a named switch, knowingly, rather than a port pair in extraPorts.
   #
   # And like every chart here: 3000 is not restricted by source in the default
   # (probe port), and a policy is only a boundary where the CNI enforces one.
@@ -184,7 +184,8 @@ networkPolicy:
     # permits its port to ANY destination. What the cap still buys is real: a
     # compromised pod cannot open arbitrary outbound connections.
     #
-    # [80, 443] is the entry to add if this release must fetch remote assets or
-    # convert URLs - and see the SSRF note above before adding it. A
-    # paperless-ngx that only converts mail bodies does not need it.
+    # Normally empty. Remote assets have their own switch above
+    # (egress.remoteAssets) and do NOT belong here, because a bare 80/443 in
+    # this list records no reason. Add a port here only for something neither
+    # the switch nor the chart covers.
     extraPorts: []