diff --git a/modules/systemd-resolved/README.md b/modules/systemd-resolved/README.md
index b7d1033..f034ce7 100644
--- a/modules/systemd-resolved/README.md
+++ b/modules/systemd-resolved/README.md
@@ -71,7 +71,8 @@ same three, plus:
 - `route` with `takes` (the write's `id`) and `by` (the module's name): route, then take that write, so
   the module's file is put back.
 
-A VPN's servers and domains go over this socket and never over the bus, so they never leave the machine.
+A VPN's servers and domains are handed over on this socket, never over the bus. They cross the bus only
+as the answer to `routes` when the operator asks it, and nothing keeps that answer.
 
 resolved holds the routes itself, per link, and forgets a link's route when the link goes. Nothing here
 keeps a table of its own that could disagree with it.