diff --git a/proxy/internal/restrict/restrict.go b/proxy/internal/restrict/restrict.go
index 134c06f20..90bddfc43 100644
--- a/proxy/internal/restrict/restrict.go
+++ b/proxy/internal/restrict/restrict.go
@@ -307,8 +307,9 @@ func (f *Filter) checkAny(addr netip.Addr, geo GeoResolver) Verdict {
 		cidrAllowed ||
 		(countryActive && country != "" && slices.Contains(f.AllowedCountries, country))
 	if !allowed {
-		// Both allowlists missing is reported against the CIDR list, the one
-		// checked first, so the reason stays stable for existing access logs.
+		// When neither allowlist admitted the address, the denial is reported
+		// against the CIDR list, the one checked first, so the reason stays
+		// stable for existing access logs.
 		if cidrActive {
 			return DenyCIDR
 		}