diff --git a/docs/runbooks/new-host.md b/docs/runbooks/new-host.md
index 1e26905..0f23f26 100644
--- a/docs/runbooks/new-host.md
+++ b/docs/runbooks/new-host.md
@@ -128,8 +128,8 @@ provisioned manually. Rationale, hardware target, and recovery model: ADR-015.
    make collections  # Ansible collections
    rbw login && rbw unlock   # vault password from Vaultwarden (see rotate-secrets.md)
    ```
-4. Join the mesh VPN (choice deferred — see ADR-015) so it is reachable over SSH
-   from elsewhere.
+4. Join the mesh VPN — NetBird, self-hosted on `askari` (ADR-016) — so it is
+   reachable over SSH from elsewhere.
 5. Add `ubongo` to `inventories/<env>/hosts.yml` under the `control` group.
 
 Because `ubongo` is not in `local.vms`, this is the only case where editing