diff --git a/ansible/inventory/hosts-publisher.yml.example b/ansible/inventory/hosts-publisher.yml.example
index 6b9a20a..3d0f014 100644
--- a/ansible/inventory/hosts-publisher.yml.example
+++ b/ansible/inventory/hosts-publisher.yml.example
@@ -18,11 +18,12 @@
 # publisher.yml. An origin is a deCDN node with an origin backend: the canonical
 # source of its namespace's content. decdn_origin_nodes is a child of decdn_nodes, so
 # an origin gets a node's firewall hole, backup, decommission and observability;
-# origin.yml refuses one outside decdn_nodes or without a backend
-# (group_vars/decdn_origin_nodes.yml). The chain recognises it as the origin only once
-# you, the namespace's publisher, seat its operator with OriginAssignment.addOrigin;
-# until then it serves its bytes as a cache does. Per-origin config (the backend,
-# region, …) goes in host_vars/<name>/main.yml (see host_vars/origin-1/).
+# origin.yml refuses one outside decdn_nodes or without a backend. The chain
+# recognises it as the origin only once you, the namespace's publisher, seat its
+# operator with OriginAssignment.addOrigin; until then it serves its bytes as a cache
+# does. The backend goes in group_vars/decdn_origin_nodes.yml (shared by every origin)
+# or host_vars/<name>/main.yml (see host_vars/origin-1/), with the region and the
+# rest of the per-origin config.
 decdn_nodes:
   children:
     decdn_origin_nodes:
diff --git a/charts/decdn-node/README.md b/charts/decdn-node/README.md
index 53252ea..689efac 100644
--- a/charts/decdn-node/README.md
+++ b/charts/decdn-node/README.md
@@ -261,8 +261,10 @@ An `fs` origin reads a path inside the pod, so the content must be on the data P
 Configuring a backend does not make the node an origin on-chain: the namespace's publisher
 seats the node's operator with `OriginAssignment.addOrigin`
 ([ADR 011](https://github.com/decdn/decdn/blob/main/adr/011-content-takedown.md#origin-assignment-authority)).
-Until then it serves its bytes as a cache does. With Ansible, the same node is the
-`decdn_node` role with `decdn_cache_origin_kind` (or `decdn_cache_origins`) set.
+Until then it serves its bytes as a cache does. With Ansible, the same node is a
+`decdn_origin_nodes` host (a child group of `decdn_nodes`, which `origin.yml` requires)
+with `decdn_cache_origin_kind` (or `decdn_cache_origins`) set, deployed by
+[`playbooks/origin.yml`](https://github.com/decdn/devops/blob/main/ansible/playbooks/origin.yml).
 
 ## Network
 
diff --git a/compose/README.md b/compose/README.md
index 0f60562..cd30555 100644
--- a/compose/README.md
+++ b/compose/README.md
@@ -6,8 +6,8 @@ commands and the same hardening as the roles' systemd units.
 
 | Profile | Service | Image | Ansible equivalent |
 |---------|---------|-------|--------------------|
-| `node` | `decdn-node`, a deCDN cache node (node operators) | `ghcr.io/decdn/decdn-node` | `decdn_node` |
-| `origin` | the same `decdn-node`, run as a publisher's origin ([below](#run-it-as-an-origin-publishers)) | `ghcr.io/decdn/decdn-node` | `decdn_node` with an origin backend (`decdn_cache_origin_kind`) |
+| `node` | `decdn-node`, a deCDN cache node (node operators) | `ghcr.io/decdn/decdn-node` | `decdn_node` on `decdn_nodes` outside `decdn_origin_nodes` ([`playbooks/node.yml`](../ansible/playbooks/node.yml)) |
+| `origin` | the same `decdn-node`, run as a publisher's origin ([below](#run-it-as-an-origin-publishers)) | `ghcr.io/decdn/decdn-node` | `decdn_node` on `decdn_origin_nodes`, with an origin backend ([`playbooks/origin.yml`](../ansible/playbooks/origin.yml)) |
 | `sponsord` | `sponsord`, the onboarding sponsor: treasury signer and PaymentPool keeper | `ghcr.io/decdn/sponsord` | `sponsord` |
 | `onramp` | `sponsord-onramp`, its public side (Turnstile gate, installers); also starts `sponsord` | `ghcr.io/decdn/sponsord-onramp` | `sponsord_onramp` |
 | `caddy` | Caddy, TLS in front of the onramp; leave it out to bring your own proxy | `caddy` (official) | `sponsord_onramp_proxy: caddy` |