diff --git a/CLAUDE.md b/CLAUDE.md
index 8dc3ec2..4fdd2e2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -317,3 +317,19 @@ A SyntaxError in any panels/ file breaks only that group — other panels stay f
 | myronblair/fusionpbx-config | FusionPBX backup | PostgreSQL dump (gzip) + FS configs, restore.sh |
 
 All repos are private. Each has `config/vhost/` with OLS vhost config. The jarvis repo also has `deploy/` (watchdog, deploy runner, systemd units) and `agent/jarvis-agent.py`.
+
+## Split DNS (added 2026-06-21)
+
+PVE1 dnsmasq (`/etc/dnsmasq.d/forwarder.conf`) has split DNS entries so all NPM-proxied domains resolve to `10.48.200.201` (NPM internal IP) for LAN clients — bypasses FortiGate hairpin NAT for HTTPS:
+
+```
+address=/jarvis.orbishosting.com/10.48.200.201
+address=/hoa.orbishosting.com/10.48.200.201
+address=/novacpx.orbishosting.com/10.48.200.201
+address=/admin.novacpx.orbishosting.com/10.48.200.201
+address=/reseller.novacpx.orbishosting.com/10.48.200.201
+address=/panel.novacpx.orbishosting.com/10.48.200.201
+address=/web.orbishosting.com/10.48.200.201
+```
+
+For any LAN device to use this: set DNS to `10.48.200.90` in Wi-Fi settings (or update FortiGate DHCP to push 10.48.200.90 as DNS for all clients).