diff --git a/garage.md b/garage.md
index fe60a8d..a5bb706 100644
--- a/garage.md
+++ b/garage.md
@@ -13,7 +13,7 @@ That trade is deliberate, and the price is the first thing to understand about t
 | Ingress | **off by default**, built to the convention so it can be switched on |
 | External dependencies | none — no database, no cache, no other service |
 | Secrets | 2 × `OnePasswordItem`, four fields in total |
-| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet |
+| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet. The admin port serves two things unauthenticated — `/health` (token-free by design, the probes need it) and `/metrics` (`metrics_require_token` defaults to **false**) — and answers everything else with 401/403 until an admin token exists, from the config *or* from `garage admin-token create` |
 | Install-test | `ci/garage/` (fixtures + test values) |
 
 ## Prerequisites