diff --git a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md
index 0deb6b9c..50750f60 100644
--- a/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md
+++ b/docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md
@@ -25,9 +25,9 @@ cookies, no credentials:
 
 | Probe | Result |
 |---|---|
-| `GET http://192.168.63.240:18083/lnd-connect-info` | `401`, 24 bytes, `{"error":"Unauthorized"}` — **closed** |
-| `POST http://192.168.63.240:8334/bitcoin-rpc/` (`getblockcount`) | `200` — `{"result":960774,"error":null}` — **OPEN** |
-| `OPTIONS http://192.168.63.240:8334/bitcoin-rpc/` | `204` with `Access-Control-Allow-Origin: *` — **OPEN** |
+| `GET http://192.0.2.240:18083/lnd-connect-info` | `401`, 24 bytes, `{"error":"Unauthorized"}` — **closed** |
+| `POST http://192.0.2.240:8334/bitcoin-rpc/` (`getblockcount`) | `200` — `{"result":960774,"error":null}` — **OPEN** |
+| `OPTIONS http://192.0.2.240:8334/bitcoin-rpc/` | `204` with `Access-Control-Allow-Origin: *` — **OPEN** |
 
 The rendered config on disk, `/var/lib/archipelago/bitcoin-ui/nginx.conf`, was dated
 **2026-06-30** — the pre-fix version, with no `auth_request` and with the wildcard CORS
@@ -88,7 +88,7 @@ Sequence, from file mtimes, container start times and the daemon journal:
 | 18:33 | Probe: `POST /bitcoin-rpc/` → `200` with a real block height. Exposure confirmed live. |
 | 18:36 | A **separate rebuild of bitcoin-ui**, done outside this work, rendered the fixed conf and recreated `archy-bitcoin-ui`. `:8334` closes here. |
 | 19:06 | The binary carrying `f6b5245b` is installed and the daemon restarted. |
-| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.168.63.240:8334`, not `*`. |
+| 19:12 | Probe: `POST /bitcoin-rpc/` → `401`. `OPTIONS` now returns `Access-Control-Allow-Origin: http://192.0.2.240:8334`, not `*`. |
 
 So the node is closed, and the fixed template is proven to work end to end on real
 hardware — but **the reconcile fix itself was never exercised.** By the time it was
@@ -118,7 +118,7 @@ which mechanism produced it.
 | 2 | Probe with no cookies | `POST /bitcoin-rpc/` → **`200`**, `{"result":960790}`; `Allow-Origin: *`. **Genuinely re-exposed** |
 | 3 | Start the daemon (20:00:36) and touch nothing further | — |
 | 4 | Reconcile pass at **20:02:19** | `bitcoin_ui: nginx.conf rendered auth_hash=51f2b5af`, then `WARN prod_orchestrator: rewrote config for a user-uninstalled app whose container is still RUNNING (systemd/Quadlet keeps it alive independently of reconcile) — restarting so it picks the new config up app_id=bitcoin-ui container=archy-bitcoin-ui` |
-| 5 | Probe again | `POST /bitcoin-rpc/` → **`401`**; `Allow-Origin: http://192.168.63.240:8334` |
+| 5 | Probe again | `POST /bitcoin-rpc/` → **`401`**; `Allow-Origin: http://192.0.2.240:8334` |
 | 6 | Compare state | Conf **byte-identical** to the pre-test known-good; container healthy |
 
 Step 2 is what makes steps 4–6 mean anything: without a confirmed `200`, the later `401`