diff --git a/migration/CUTOVER.md b/migration/CUTOVER.md
index 784f2fd..d666063 100644
--- a/migration/CUTOVER.md
+++ b/migration/CUTOVER.md
@@ -156,8 +156,15 @@ USG, and debug with the internet back on.
   LoT — they get their addresses from VyOS now.
 - **DHCP leases last 24h (86400s).** A device that does not renew promptly keeps
   its old address for a while. That is fine, not a symptom.
-- **The firewalls resolve via `10.0.0.194`**, not the USG. That was changed
-  ahead of time precisely so they keep DNS when the USG goes away.
+- **The firewalls resolve via `8.8.8.8` / `8.8.4.4`** — matching the DNS the USG
+  used on its WAN. This means their own name resolution now depends on the
+  *internet* being up, so between unplugging the USG and PPPoE establishing,
+  the boxes have no DNS at all. That is expected and harmless: they only need
+  DNS for NTP hostnames, and the switch's own health checks use it precisely to
+  prove the WAN came up. Nothing in the switch itself resolves a name.
+- Internal `ad.itaz.eu` names still resolve through Google, because that zone is
+  published publicly with private addresses in it (`nas001` → `10.0.0.194`,
+  `kvm-macstudio1` → `192.168.3.8`). Convenient here; worth knowing it is public.
 - **The USG was a DNS resolver** for every VLAN except LoT. VyOS now runs
   `dns forwarding` in its place. If names stop resolving but IPs still work,
   that is where to look.