diff --git a/src/pages/for/p2p.astro b/src/pages/for/p2p.astro
index da0e4b1..8b40ff3 100644
--- a/src/pages/for/p2p.astro
+++ b/src/pages/for/p2p.astro
@@ -62,7 +62,7 @@ const canonicalUrl = "https://pilotprotocol.network/for/p2p";
       <div class="feat">
         <div class="feat-ix">Latency</div>
         <div class="feat-t">Zero-hop data path</div>
-        <div class="feat-d">Packets travel the exact network RTT between the two machines. No relay, no gateway, no broker queue sitting in between adding tens of milliseconds.</div>
+        <div class="feat-d">On a direct path, packets travel the exact network RTT between the two machines — no gateway, no broker queue sitting in between adding tens of milliseconds. Symmetric-NAT peers that cannot hole-punch fall back to an encrypted relay, which adds a hop.</div>
       </div>
       <div class="feat">
         <div class="feat-ix">Security</div>
@@ -72,7 +72,7 @@ const canonicalUrl = "https://pilotprotocol.network/for/p2p";
       <div class="feat">
         <div class="feat-ix">Ops</div>
         <div class="feat-t">No servers to run</div>
-        <div class="feat-d">No message broker to scale. No gateway fleet to patch. The only long-running service is the daemon on each agent machine.</div>
+        <div class="feat-d">No message broker to scale. No gateway fleet to patch. The only service you run is the daemon on each agent machine — discovery and NAT traversal use the Pilot-operated registry and beacon.</div>
       </div>
       <div class="feat">
         <div class="feat-ix">Scale</div>
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 72caadc..676bba2 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -527,7 +527,7 @@ try {
 
       <div>
         <div class="how-lede">
-          Peer-to-peer encrypted tunnels at the <em>UDP layer</em>. A thin registry for discovery, then data flows directly between peers. No external dependencies.
+          Peer-to-peer encrypted tunnels at the <em>UDP layer</em>. A hosted registry and beacon handle discovery and NAT traversal, then data flows directly between peers — with an encrypted relay fallback when symmetric NAT blocks a direct path.
         </div>
 
         <ul class="how-steps">
diff --git a/src/pages/plain/p2p.astro b/src/pages/plain/p2p.astro
index 588af46..3920612 100644
--- a/src/pages/plain/p2p.astro
+++ b/src/pages/plain/p2p.astro
@@ -12,9 +12,9 @@ import PlainLayout from '../../layouts/PlainLayout.astro';
 
 <h2>Hub-and-spoke is a bottleneck</h2>
 <ul>
-  <li>Latency: Packets travel the network RTT between two machines. There is no relay, gateway, or message broker queue.</li>
+  <li>Latency: On a direct path, packets travel the network RTT between two machines with no gateway or message broker queue. Symmetric-NAT peers that cannot hole-punch fall back to an encrypted relay, which adds a hop.</li>
   <li>Security: Connections are end-to-end encrypted by default using X25519 key exchange and AES-256-GCM authenticated encryption. This can be disabled with the `--no-encrypt` flag.</li>
-  <li>Ops: The only long-running service is the daemon on each agent machine. No message broker or gateway fleet is required.</li>
+  <li>Ops: The only service you run is the daemon on each agent machine. No message broker or gateway fleet is required. Discovery and NAT traversal use the Pilot-operated registry and beacon.</li>
   <li>Scale: The network grows with the number of agents. Each new peer adds a tunnel to its correspondents, with no central fan-in limit.</li>
 </ul>