diff --git a/services/arr-interconnect.nix b/services/arr-interconnect.nix
index 9bdd9df..90f0341 100644
--- a/services/arr-interconnect.nix
+++ b/services/arr-interconnect.nix
@@ -201,6 +201,20 @@ let
 
     ##########################################################################
     # Sonarr → qBittorrent (download client for TV)
+    #
+    # username/password are deliberately empty: qBittorrent's runtime config
+    # has `WebUI\LocalHostAuth=false`, so connections from 127.0.0.1 skip auth.
+    # Every consumer here reaches it as host "localhost", and Shelfarr does too
+    # because it runs --network=host, so loopback covers all of them. Don't
+    # re-enable localhost auth without putting real credentials in these two
+    # blocks first, or downloads silently stop being grabbed.
+    #
+    # qBittorrent also has `WebUI\AuthSubnetWhitelistEnabled=true` covering
+    # 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Nothing here needs that —
+    # it only hands the unauthenticated admin API (setPreferences included, so
+    # autorun_program, so command execution) to every LAN device and every
+    # container. Safe to turn off; the loopback bypass above is the load-bearing
+    # half.
     ##########################################################################
     if [ -n "$SONARR_KEY" ]; then
       if ! exists_by_name "$BASE:8989/api/v3/downloadclient" "$SONARR_KEY" "qBittorrent"; then