diff --git a/docs/network/allow-caddy-to-apps.md b/docs/network/allow-caddy-to-apps.md
index 0cd871a..a638b2b 100644
--- a/docs/network/allow-caddy-to-apps.md
+++ b/docs/network/allow-caddy-to-apps.md
@@ -99,7 +99,7 @@ Every policy in this table uses:
 | `ALLOW CADDY to Bento PDF` | `10.0.10.6` | `8080` | Bento PDF |
 | `ALLOW CADDY to Koffan` | `10.0.10.12` | `8080` | Koffan (LXC 111) |
 | `ALLOW CADDY to Hermes` | `10.0.10.19` | `9119` | Hermes Agent dashboard (LXC 113) |
-| `ALLOW CADDY to Forgejo` | `10.0.10.18` | `3000` | Forgejo (LXC 114) |
+| `ALLOW CADDY to Forgejo` | `10.0.10.18` | `3000,2222` | Forgejo web UI (LXC 114) and git-over-SSH for hosts pulling from raspberrypi's zone |
 
 ---
 
@@ -152,6 +152,21 @@ allow it, and both were found misconfigured while wiring this up:**
    sudo ufw allow from 10.0.30.0/24 to any port 80,443 proto tcp
    ```
 
+## 3b. CADDY / IoT → Forgejo git-over-SSH (port 2222)
+
+Both raspberrypi (CADDY zone) and Home Assistant (IoT zone) clone
+`homelab-blueprint` over SSH directly against the Forgejo LXC
+(`10.0.10.18:2222`), bypassing Caddy entirely — SSH can't be proxied
+through Caddy (HTTP/S only), so this traffic goes straight to the TRUSTED
+zone. `10.0.10.18` has no host-level firewall (`ufw` not installed,
+`iptables INPUT` policy `ACCEPT`), so only the UniFi zone rule matters
+here — no second enforcement layer to fight, unlike the Caddy host above.
+
+| Policy name | Source zone | Source IP | Destination zone | Destination IP | Destination port(s) | Purpose |
+|---|---|---|---|---|---|---|
+| `ALLOW CADDY to Forgejo` (existing rule, port added) | `CADDY` | `10.0.15.5` | `TRUSTED` | `10.0.10.18` | `3000,2222` | Forgejo web UI + git-over-SSH from raspberrypi |
+| `Allow HA to Forgejo SSH` | `IoT` | `10.0.30.6` | `TRUSTED` | `10.0.10.18` | `2222` | git-over-SSH from homeassistant |
+
    `ufw status` on that host is the fastest way to check which subnets can
    already reach it before assuming a UniFi rule is the problem.