diff --git a/bastion/src/bastion/src/templates/dnsmasq.conf.ts b/bastion/src/bastion/src/templates/dnsmasq.conf.ts
index af972da..fc0762c 100644
--- a/bastion/src/bastion/src/templates/dnsmasq.conf.ts
+++ b/bastion/src/bastion/src/templates/dnsmasq.conf.ts
@@ -48,15 +48,20 @@ enable-tftp
 tftp-root=${tftpDir}
 tftp-no-blocksize
 
-# Detect client architecture -- PXE (TFTP) clients
+# Detect client architecture -- PXE (TFTP) clients.
+# Values are DHCP option 93 (Client System Architecture), IANA "Processor Architecture
+# Types". Getting these wrong means the machine is handed a bootloader its firmware
+# cannot execute, and it loops or hangs with no console output.
 dhcp-match=set:bios,option:client-arch,0
 dhcp-match=set:efi-x86_64,option:client-arch,7
 dhcp-match=set:efi-x86_64,option:client-arch,9
 dhcp-match=set:efi-arm64,option:client-arch,11
 
-# Detect client architecture -- UEFI HTTP Boot clients (no TFTP size limit)
+# Detect client architecture -- UEFI HTTP Boot clients (no TFTP size limit).
+# 16 = x64 uefi boot from http, 19 = arm uefi 64 boot from http.
+# (20 is pc/at bios boot from http -- not arm64.)
 dhcp-match=set:httpboot-x86_64,option:client-arch,16
-dhcp-match=set:httpboot-arm64,option:client-arch,20
+dhcp-match=set:httpboot-arm64,option:client-arch,19
 
 # Detect iPXE clients (already chainloaded)
 dhcp-userclass=set:ipxe,iPXE