diff --git a/docs/setup.md b/docs/setup.md
index 2b968c8..51cbcd0 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -90,7 +90,7 @@ by `database_id`):
   `wrangler.jsonc`.
 - **KV** `75a4c5d58e1f449080bf8be64a995a5a` (binding `KV`).
 
-### nbread.lol migration — PENDING (see the rename plan, Phase 5)
+### nbread.lol migration — PENDING (target state after the domain migration)
 
 The project moved from `nostrbook.net` to **`nbread.lol`**. The following are the
 target state and are **not yet provisioned** — the committed `wrangler.jsonc`
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 6c5d0b3..f3a106d 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -34,8 +34,11 @@
     // "development" here — it enables the client-spoofable X-Forwarded-Host
     // override in src/middleware/guard.ts.
     "ENVIRONMENT": "production",
-    // Real Turnstile widget (Sovereign IT → "nbread", Managed) for
-    // nbread.lol + the workers.dev preview host. Secret is a wrangler secret.
+    // NOTE: carried over from the old nostrbook.net Turnstile widget — this
+    // key will FAIL the hostname check on nbread.lol until a widget is
+    // (re)pointed at nbread.lol + the workers.dev preview host and this value
+    // + TURNSTILE_SECRET_KEY are updated (see docs/setup.md §6). Secret is a
+    // wrangler secret.
     "TURNSTILE_SITE_KEY": "0x4AAAAAAD1JzzXDBykpiavq",
     // Default relays: the service-wide fallback used for cron sync + NIP-05
     // relay hints when a user has not set their own list (dashboard settings