diff --git a/README.md b/README.md
index 8548827..b16f5c5 100644
--- a/README.md
+++ b/README.md
@@ -37,9 +37,9 @@ Operators use the `wristcode` CLI inside the container, on junior.gib:
 t3 auth pairing create --scope orchestration:read --scope orchestration:operate --label "WristCode gateway"
 podman exec -it wristcode-gateway wristcode host add https://t3mac.gbrown.org <credential> --label "Mac mini"
 
-# A host reachable more than one way, such as a laptop with a VPN route, lists fallbacks.
-# The gateway tries them in order when the first does not answer.
-podman exec -it wristcode-gateway wristcode host add https://t3laptop.gbrown.org <credential> --label "Laptop" --alt-url https://t3laptopvpn.gbrown.org
+# A host reachable more than one way lists fallbacks, preferred first. The gateway uses the
+# first route that answers: here a direct WireGuard address, then the public URL.
+podman exec -it wristcode-gateway wristcode host add http://desktop.gib:3773 <credential> --label "Desktop" --alt-url https://t3desktop.gbrown.org
 
 # Pair a watch: enter the printed code on the watch within 5 minutes.
 podman exec -it wristcode-gateway wristcode pair
diff --git a/scripts/renew-hosts.sh b/scripts/renew-hosts.sh
index 3696591..79470f6 100755
--- a/scripts/renew-hosts.sh
+++ b/scripts/renew-hosts.sh
@@ -13,15 +13,17 @@ GATEWAY_SSH="${GATEWAY_SSH:-junior.gib}"
 GATEWAY_RUNTIME="${GATEWAY_RUNTIME:-podman}"
 GATEWAY_CONTAINER="${GATEWAY_CONTAINER:-wristcode-gateway}"
 
-# label | SSH host, or "local" for the machine running this script | public T3 URLs
-# A host can list several URLs, space separated, preferred first. The gateway falls back to the
-# next one when a route does not answer, such as the laptop's VPN route when it is away from home.
+# label | SSH host, or "local" for the machine running this script | T3 URLs
+# URLs are space separated, preferred first. The gateway uses the first one that answers. Direct
+# routes come first: from junior they cross WireGuard straight to the machine, so they skip
+# Cloudflare and the home server's tunnel and proxy. The public URLs are the fallback. LittleMan is
+# junior itself, reached at its own WireGuard address.
 HOSTS=(
-  "Desktop|local|https://t3desktop.gbrown.org"
-  "Mac mini|mac.gib|https://t3mac.gbrown.org"
-  "server-gib|server.gib|https://t3sr.gbrown.org"
-  "LittleMan|junior.gib|https://t3jr.gbrown.org"
-  "Laptop|laptop.gib|https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
+  "Desktop|local|http://desktop.gib:3773 https://t3desktop.gbrown.org"
+  "Mac mini|mac.gib|http://mac.gib:3773 https://t3mac.gbrown.org"
+  "server-gib|server.gib|http://server.gib:3773 https://t3sr.gbrown.org"
+  "LittleMan|junior.gib|http://192.168.2.2:3773 https://t3jr.gbrown.org"
+  "Laptop|laptop.gib|http://laptop.gib:3773 http://laptopvpn.gib:3773 https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
 )
 
 # Prints a pairing credential. Runs on the T3 host. The CLI is not on PATH in non-login shells,