diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index e995739c..bd7b7a1a 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -33,14 +33,14 @@ graph TD
     Backend -->|S3 API :9000| MinIO[(MinIO)]
     Backend -->|HTTP :8000 internal| OCR["OCR Service\nPython FastAPI"]
     OCR -->|presigned URL| MinIO
-    Browser -->|SSE direct| Backend
+    Caddy -->|SSE proxy_pass| Backend
 ```
 
 **Key facts:**
 - Caddy terminates TLS and reverse-proxies to frontend (`:3000`) and backend (`:8080`). The Caddyfile is committed at [`infra/caddy/Caddyfile`](../infra/caddy/Caddyfile) and is installed on the host as `/etc/caddy/Caddyfile` (symlink).
 - The host binds all docker-published ports to `127.0.0.1` only; Caddy is the sole external entry point.
 - The OCR service has **no published port** — reachable only on the internal Docker network from the backend.
-- SSE notifications go directly backend → browser (not via the SvelteKit SSR layer).
+- SSE notifications transit Caddy (browser → Caddy → backend); the backend is never reachable directly from the public internet. The SvelteKit SSR layer is bypassed for SSE, but Caddy is not.
 - The Caddyfile responds `404` on `/actuator/*` (defense in depth). Internal monitoring scrapes the backend on the docker network, not through Caddy.
 - Production and staging cohabit on the same host via docker compose project names: `archiv-production` (ports 8080/3000) and `archiv-staging` (ports 8081/3001).