diff --git a/deploy/k8s/service.yaml b/deploy/k8s/service.yaml
index c118abfc..e6f9ec7e 100644
--- a/deploy/k8s/service.yaml
+++ b/deploy/k8s/service.yaml
@@ -25,7 +25,14 @@ spec:
       name: http
 ---
 # External access via LoadBalancer
-# For Exoscale SKS, this provisions an Exoscale NLB
+# For Exoscale SKS, this provisions an Exoscale NLB.
+#
+# The NLB forwards to this Service's NodePort and TCP-healthchecks it on
+# the node. The cloud controller does NOT open that port in the node's
+# security group — the operator must, or the NLB IP refuses connections
+# while the pod is Ready (2026-10-04, tablet 29):
+#   PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}')
+#   exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0
 apiVersion: v1
 kind: Service
 metadata: