diff --git a/nix/modules/orchestrator-host.nix b/nix/modules/orchestrator-host.nix
index 676b458..90e9db1 100644
--- a/nix/modules/orchestrator-host.nix
+++ b/nix/modules/orchestrator-host.nix
@@ -31,7 +31,7 @@ in
 
     opencodeUiBackendPort = lib.mkOption {
       type = lib.types.port;
-      default = 8080;
+      default = 8090;   # not 8080: acme-dns's local API has it on the combined host
       description = ''
         Plain-HTTP port nginx listens on for the opencode UI, reachable ONLY from the docker
         bridge (firewall rule on docker_gwbridge). Traefik — which owns the public 443 on the
@@ -45,9 +45,12 @@ in
       default = null;
       example = "/var/lib/docker/volumes/traefik_ci_commoninternet_net_file-providers/_data";
       description = ''
-        Host path of the traefik stack's file-providers directory (watched by traefik). When set,
-        a dynamic-config file routing opencodeUiHost on the `web-secure` entrypoint to nginx is
-        written there after deploy-proxy. null = no traefik route (serve some other way).
+        Host path of the traefik stack's file-providers directory. When set, a dynamic-config
+        file routing opencodeUiHost on the `web-secure` entrypoint to nginx is written there after
+        deploy-proxy. Traefik only watches that directory when the coop-cloud traefik recipe is
+        deployed with FILE_PROVIDER_DIRECTORY_ENABLED=1 in its app env
+        (/root/.abra/servers/default/<traefik domain>.env) — see README "Stage the workspace".
+        null = no traefik route.
       '';
     };