diff --git a/docs/plans/2026-10-11_webui-preview.md b/docs/plans/2026-10-11_webui-preview.md
index 928d9dbbf..59fd510f2 100644
--- a/docs/plans/2026-10-11_webui-preview.md
+++ b/docs/plans/2026-10-11_webui-preview.md
@@ -55,8 +55,12 @@ exactly as today, and the existing tests show it.
 
 - `serve --public-host NAME --auth-header HEADER --allow-user ID`, all
   three or none. The check is generic: one header name and one user id,
-  both from the flags, nothing provider-specific in code or tests. NAME is a hostname, no port or scheme. The bind stays
-  loopback; nothing here listens beyond it.
+  both from the flags, nothing provider-specific in code or tests.
+  Node lowercases incoming header names, so HEADER matches without
+  regard to case (`X-authentik-uid` on the flag finds
+  `x-authentik-uid`), and a test shows it. The value compare is exact.
+  NAME is a hostname, no port or scheme. The bind stays loopback;
+  nothing here listens beyond it.
 - In preview mode a request's Host must be NAME, or loopback on the
   Console's port as today. An Origin, when sent, must be `https://NAME`
   for a NAME request, and the loopback form for a loopback request.
@@ -75,7 +79,9 @@ exactly as today, and the existing tests show it.
 - The README replaces "Do not expose either unauthenticated server
   through a public proxy" with what the preview mode requires of the
   proxy: it strips HEADER from every client request and sets it only
-  after the identity provider signs the user in, it preserves Host, it terminates TLS,
+  after the identity provider signs the user in, it forwards only
+  requests whose Host is NAME and preserves that Host (a forwarded
+  loopback Host would skip the header check), it terminates TLS,
   and it is the only thing that reaches the port from off the host. It
   says plainly that any local process can still connect and send HEADER,
   the same exposure the README already describes for the port.