diff --git a/containers/webapp-entrypoint.sh b/containers/webapp-entrypoint.sh
index 98ddfe2..9e8d5b0 100755
--- a/containers/webapp-entrypoint.sh
+++ b/containers/webapp-entrypoint.sh
@@ -3,17 +3,26 @@ set -euo pipefail
 
 if [[ "${CI:-}" == "true" ]]; then
   # ── CI path ────────────────────────────────────────────────────────
-  # In CI, contracts.env is NOT sourced here. Instead, the calling CI step
-  # (.woodpecker/e2e.yml) sources contracts.env itself and exports
-  # VITE_KRAIKEN_ADDRESS and VITE_STAKE_ADDRESS directly into the environment
-  # before this entrypoint runs. The :? guards below enforce that those
-  # variables have been provided.
+  # NOTE: this block is NOT executed by the .woodpecker/e2e.yml pipeline.
+  # Woodpecker runs the webapp image as a service with a `commands:` block,
+  # which replaces the Docker ENTRYPOINT entirely — dumb-init and this script
+  # are bypassed. The e2e.yml commands block sources contracts.env and starts
+  # `npm run dev` inline (see .woodpecker/e2e.yml, webapp service, ~line 129).
+  #
+  # This path fires only for manual invocations, e.g.:
+  #   docker run -e CI=true \
+  #     -e VITE_KRAIKEN_ADDRESS=0x... \
+  #     -e VITE_STAKE_ADDRESS=0x... \
+  #     webapp-ci
+  #
+  # VITE_KRAIKEN_ADDRESS and VITE_STAKE_ADDRESS must be supplied by the caller;
+  # they are not derived from contracts.env here.
   cd /app/web-app
 
   echo "[webapp-ci] Starting Web App..."
 
-  : "${VITE_KRAIKEN_ADDRESS:?VITE_KRAIKEN_ADDRESS is required — set by .woodpecker/e2e.yml from contracts.env}"
-  : "${VITE_STAKE_ADDRESS:?VITE_STAKE_ADDRESS is required — set by .woodpecker/e2e.yml from contracts.env}"
+  : "${VITE_KRAIKEN_ADDRESS:?VITE_KRAIKEN_ADDRESS must be supplied by the caller (not sourced from contracts.env in this path)}"
+  : "${VITE_STAKE_ADDRESS:?VITE_STAKE_ADDRESS must be supplied by the caller (not sourced from contracts.env in this path)}"
 
   # Disable Vue DevTools in CI to avoid path resolution issues
   export CI=true