diff --git a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx
index d1eb0f47..2af088d2 100644
--- a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx
+++ b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx
@@ -299,7 +299,7 @@ Apply both with `docker compose up -d proxy traefik`. The proxy's main port stay
 
 ### Enabling peer-to-peer connectivity
 
-The proxy runs an embedded NetBird client to reach your peers. When the proxy runs in a container or behind NAT, it only knows its internal address and a random WireGuard port, so peers usually cannot reach it directly and fall back to a relay. To let peers establish direct peer-to-peer connections to the proxy:
+The proxy runs an embedded NetBird client to reach your peers. Like any NetBird client, it discovers its public address through STUN. If no STUN server is reachable, or the STUN server cannot see the proxy's public address (for example, when it runs in an adjacent container on the same host), the proxy only advertises its internal address and peers fall back to a relay. In that case, to let peers establish direct peer-to-peer connections to the proxy:
 
 1. Set a fixed WireGuard port with `NB_PROXY_WG_PORT`.
 2. Forward that UDP port on your NAT or firewall to the proxy host, and publish it on the proxy container.