diff --git a/roles/base/tasks/mesh.yml b/roles/base/tasks/mesh.yml
index 83786ef..17a8b1e 100644
--- a/roles/base/tasks/mesh.yml
+++ b/roles/base/tasks/mesh.yml
@@ -71,7 +71,9 @@
     regexp: '\s{{ _coordinator_fqdn | regex_escape }}$'
     line: "{{ base__mesh_coordinator_pin }} {{ _coordinator_fqdn }}"
     state: present
-    unsafe_writes: true   # /etc/hosts is a bind mount in Docker; atomic rename is impossible
+    # /etc/hosts is bind-mounted in the Docker Molecule container (atomic rename → EBUSY);
+    # this is a fallback only — production VMs still write atomically.
+    unsafe_writes: true
   vars:
     _coordinator_fqdn: "{{ base__mesh_management_url | regex_replace('^https?://', '') | regex_replace('[:/].*', '') }}"
   when: