diff --git a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
index abe364e2..004b9e02 100644
--- a/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
+++ b/src/pages/selfhosted/maintenance/scaling/high-availability-from-installer.mdx
@@ -295,7 +295,12 @@ From here on, TLS and routing move from the installer's Traefik to your load bal
 
    Keep the installer's `.env` beside it: it supplies the domain, image tags and license key.
 
-   Before you start the node, allow ports 80 and 8080 on it from the load balancer only, at a network firewall or cloud security group. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else. Remove the rules that opened ports 80 and 443 to the internet for Traefik. A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules.
+   Before you start the node, change its rules at a network firewall or cloud security group:
+
+   - Allow TCP 80 and 8080 from the load balancer only. The server serves its API and login page on port 80 in plain HTTP, so it must not be reachable from anywhere else.
+   - Remove the rules the installer needed: TCP 80 and 443 from the internet, which Traefik used, and UDP 3478, which the built-in STUN server used. STUN now runs on the relay instances.
+
+   A host firewall such as UFW or firewalld does not restrict these ports, because Docker-published ports bypass those rules.
 
    Then start the node: