diff --git a/docs/design/dns-architecture.md b/docs/design/dns-architecture.md
index 6aa94f885..bc060807e 100644
--- a/docs/design/dns-architecture.md
+++ b/docs/design/dns-architecture.md
@@ -121,7 +121,7 @@ Zones created by HyperShift CPO in the customer account (not delegated from shar
 | :---------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------ | :----------------- | :------------------------------------------------------------------------- |
 | `deployment_name` | 1–25 characters | Subdomain for a regional deployment. Defaults to the AWS region name; suffixed when multiple deployments share a region or for per-run CI environments. | Service            | `us-east-1` (len 9), `us-east-1-2` (len 12), `us-east-1-eph-a1b2` (len 19) |
 | `zone_shard`      | 1–3 characters  | Subdomain for a regional deployment's HostedZone shard (capped at 100)                                                                                  | Service            | `0` (len 1), `99` (len 2)                                                  |
-| `hash4`           | 4 characters    | Slug to allow duplicate `cluster_alias`                                                                                                                 | Service            | `1fb9` (len 4)                                                             |
+| `hash4`           | 4 characters    | Unique slug per `cluster_alias` within a zone shard; derived from cluster UUID, uniqueness enforced by platform-api at creation time                    | Service            | `1fb9` (len 4)                                                             |
 | `cluster_alias`   | 1–15 characters | Alias for the cluster: user-provided (`domain_prefix`) or service-generated hash                                                                        | Service / Customer | `typeidhcp` (len 10), `4354c27df47cf4e` (len 15)                           |
 
 All identifiers must be DNS-subdomain compatible: lowercase alphanumeric characters or `-`, starting and ending with an alphanumeric character.