diff --git a/src/pages/client/mdm-integration.mdx b/src/pages/client/mdm-integration.mdx
index 4d274633..d41d852c 100644
--- a/src/pages/client/mdm-integration.mdx
+++ b/src/pages/client/mdm-integration.mdx
@@ -453,13 +453,14 @@ to the connection — `managementURL`, `preSharedKey`, `rosenpassEnabled`,
 | `disableNetworks` | Removes the Resources tab |
 | `disableAdvancedView` | Hides Advanced (on tvOS, the whole section) |
 | `disableUpdateSettings` | Read-only mode: nothing is hidden, every configuration control is locked |
-| `allowRemoteJobs` | Locks the remote debug bundle toggle |
 
 The table above is what the user sees. A second group of keys has no
 control to lock, because the engine applies them straight to the
-connection: `blockInbound`, `wireguardPort`, `lazyConnection`, and
-`debugBundleUploadURL` when a remote job produces a bundle. They are
-enforced just the same — there is simply nothing on screen to mark.
+connection: `blockInbound`, `wireguardPort`, `lazyConnection`,
+`allowRemoteJobs`, and `debugBundleUploadURL` when a remote job produces
+a bundle. They are enforced just the same — a peer whose policy withholds
+`allowRemoteJobs` refuses those jobs — there is simply nothing on screen
+to mark yet.
 
 The rest do not apply to the platform and are parsed and ignored:
 `allowServerSSH` (no SSH server on iOS), `disableServerRoutes` (an iOS