diff --git a/docs/03-flux.md b/docs/03-flux.md
index b6cf8e6..980b683 100644
--- a/docs/03-flux.md
+++ b/docs/03-flux.md
@@ -438,14 +438,18 @@ headlamp and the k3s API server are deliberately **not** exposed this way;
 step 5 above and `docs/04-tofu.md` step 5 cover why and how to reach them
 instead.
 
-Two DNS records, as CNAMEs pointed at `git.boglabob.com` rather than
-duplicating its IP directly — CNAME means "this name is an alias for that
-one," so there's one place (that record) to update if the underlying IP
-ever changes, instead of several:
+Two DNS records, as CNAMEs pointed at the bare apex `boglabob.com` — the
+zone's one actual A record — rather than duplicating its IP directly.
+This matches every other hostname on this server (`git`, `photos`,
+`music`, etc. are all `CNAME`s to the apex too); it's *not* about
+`git.boglabob.com` being some special canonical host to alias through —
+an earlier version of this doc got that wrong, pointing these two at
+`git.boglabob.com` instead of the apex, inconsistent with every other
+record in the zone:
 
 ```
-podinfo.boglabob.com  CNAME  git.boglabob.com
-hello.boglabob.com    CNAME  git.boglabob.com
+podinfo.boglabob.com  CNAME  boglabob.com
+hello.boglabob.com    CNAME  boglabob.com
 ```
 
 Then in Caddy's own config, using the VM's pinned IP from stage 2: