diff --git a/Vagrantfile b/Vagrantfile
index 6befefe..3bc0b5a 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -25,6 +25,11 @@
 #   vagrant destroy -f
 
 # Pre-shared token for all k3s nodes. Dev-only — do not reuse for prod.
+# needtofix L19/L20 (accepted, dev-only): this is a local throwaway Vagrant
+# cluster on a private host-only network. The hardcoded join token, the
+# world-readable kubeconfig (0644, so the host can read the synced admin.conf),
+# and the unpinned curl|sh k3s install are deliberate dev conveniences. NEVER
+# expose this cluster or reuse these values outside local development.
 K3S_TOKEN = "forail-dev-cluster-shared-token-do-not-reuse"
 K3S_VERSION = "v1.30.4+k3s1"
 INIT_SERVER_IP = "192.168.56.30"
diff --git a/scripts/server-init.sh b/scripts/server-init.sh
index 6e7f8e7..59f2c9f 100755
--- a/scripts/server-init.sh
+++ b/scripts/server-init.sh
@@ -54,6 +54,9 @@ done
 
 # Publish kubeconfig with the right server URL (default is 127.0.0.1)
 # so the host can use it directly via $KUBECONFIG=shared/admin.conf.
+# needtofix L19 (accepted, dev-only): 0644 is required so the host user can
+# read the Vagrant-synced admin.conf. This grants cluster-admin to anyone with
+# the file — fine for a local throwaway cluster only.
 sed "s|server: https://127.0.0.1:6443|server: https://${NODE_IP}:6443|" \
     /etc/rancher/k3s/k3s.yaml > "$SHARED_DIR/admin.conf"
 chmod 644 "$SHARED_DIR/admin.conf"