diff --git a/pkg/clouds/pulumi/kubernetes/caddy.go b/pkg/clouds/pulumi/kubernetes/caddy.go
index ab7cebb6..2d00f856 100644
--- a/pkg/clouds/pulumi/kubernetes/caddy.go
+++ b/pkg/clouds/pulumi/kubernetes/caddy.go
@@ -123,6 +123,14 @@ func DeployCaddyService(ctx *sdk.Context, caddy CaddyDeployment, input api.Resou
 	// - Operators can override the 503 body by mounting a different ConfigMap
 	//   at /etc/caddy/pages/503.html without touching SC api code.
 	//
+	// Keep pages/503.html generic — it answers every unknown Host for
+	// unauthenticated clients, which cannot be distinguished from operators.
+	// No stack identifiers, internal paths, or remediation runbooks in the
+	// body OR in HTML comments (comments ship in the response too — that was
+	// the bug behind this very page once leaking the caddyfile-entry runbook).
+	// The operator runbook for "no backend route for this Host" is this
+	// comment block plus the generate-caddyfile init-container logs.
+	//
 	// Wrapped in `handle { ... }` so the directives below apply only to the
 	// 503 path and nothing else can short-circuit (e.g. `import hsts` redir
 	// firing before the response). We also intentionally do NOT `import hsts`
diff --git a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
index 10e2d314..1df5931e 100644
--- a/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
+++ b/pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
@@ -7,15 +7,7 @@
     article { display: block; text-align: left; width: 650px; margin: 0 auto; }
 </style>
 
-<!--
-  Public-facing body only. Do NOT add operator runbooks, stack
-  identifiers (simple-container.com / Caddy / k8s annotations), or
-  remediation hints here: this catch-all answers every unknown Host for
-  unauthenticated clients and cannot distinguish an operator from an
-  attacker. The runbook for "no backend route for this Host" lives in
-  pkg/clouds/pulumi/kubernetes/caddy.go (default 503 block rationale)
-  and in the generate-caddyfile init-container logs.
--->
+<!-- Served to unauthenticated clients on any unknown host. Keep generic: no internal, infrastructure, or diagnostic detail (this comment ships in the response). -->
 <article>
     <h1>503 Service Unavailable</h1>
     <p>This service is temporarily unavailable. Please try again in a few moments.</p>