diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run
index 05ca058549..481f2ea447 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run
@@ -14,8 +14,8 @@ fi
 # Tell S6-Overlay not to restart this service
 s6-svc -O .
 
-# Runs as root before any /config path enters the environment; -I skips the
-# user site-packages under $HOME
+# This runs as root before any /config path enters the environment; -I skips
+# the user site-packages under $HOME
 function set_libva_version() {
     local ffmpeg_path
     ffmpeg_path=$(python3 -I /usr/local/ffmpeg/get_ffmpeg_path.py)
@@ -26,10 +26,10 @@ function set_libva_version() {
 echo "[INFO] Preparing Frigate..."
 set_libva_version
 
-# HOME=/root survives s6-setuidgid, so the drop sets HOME=/config. The runtime
-# user owns /config, so these paths go only to the service process, never to
-# root. Detector runtimes installed at first start (pip install --user) live
-# under $HOME/.local.
+# HOME=/root survives s6-setuidgid, so any run that is not root gets
+# HOME=/config explicitly. The runtime user owns /config, so these paths go
+# only to the service process, never to root. Detector runtimes installed at
+# first start (pip install --user) live under $HOME/.local.
 run_as=()
 runtime_home="${HOME}"
 if [[ "$runs_as_root" -eq 0 ]]; then
diff --git a/docker/main/rootfs/usr/local/go2rtc/create_config.py b/docker/main/rootfs/usr/local/go2rtc/create_config.py
index 1939b8d916..e9b111f93f 100644
--- a/docker/main/rootfs/usr/local/go2rtc/create_config.py
+++ b/docker/main/rootfs/usr/local/go2rtc/create_config.py
@@ -199,8 +199,8 @@ if config.get("birdseye", {}).get("restream", False):
         go2rtc_config["streams"] = {"birdseye": ffmpeg_cmd}
 
 # The run script removes the old file first. Exclusive create never follows a
-# link the go2rtc user planted in sticky /dev/shm. 0640 because the config
-# contains camera credentials.
+# link the go2rtc user planted in sticky /dev/shm. The config contains camera
+# credentials, so it is not world-readable.
 fd = os.open(
     "/dev/shm/go2rtc.yaml",
     os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,