diff --git a/serving/docker-compose.yml b/serving/docker-compose.yml
index bc9ab83..9e052ac 100644
--- a/serving/docker-compose.yml
+++ b/serving/docker-compose.yml
@@ -268,6 +268,14 @@ services:
     # HOST clock (the clock isn't namespaced) — intended: the serving host is the
     # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already
     # runs its own NTP and you only want this to relay.
+    #
+    # FIREWALL (easy to miss — same trap as the audit collector's 514/tcp): host
+    # networking means Docker does NOT open the port; the serving host's own
+    # firewall governs 123/udp. Without a rule, workstations get 192.168.50.10 as
+    # their NTP server (DHCP opt 42) but their packets are dropped — chrony logs
+    # "Added source … / unreachable" and never syncs. Open it on the boot-LAN NIC:
+    #   ufw:       sudo ufw allow in on <boot-nic> to any port 123 proto udp comment 'fleet NTP'
+    #   firewalld: sudo firewall-cmd --permanent --add-service=ntp && sudo firewall-cmd --reload
 
   # --- Remote audit / log collector (RECEIVE side) ---------------------------
   # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses