diff --git a/.env.production.example b/.env.production.example
index 06ff00f4b..c87444ee7 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -524,13 +524,14 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # Optional log shipping to a Loki instance. LOKI_ENDPOINT turns shipping on.
 # Either form works: the base URL (http://loki:3100) or the full push URL
 # (http://loki:3100/loki/api/v1/push). A Loki on your own network is fine,
-# private addresses and internal hostnames included; only link-local and
-# cloud-metadata addresses are refused. The username/password pair is only
-# needed when your Loki sits behind basic auth. When a push fails (Loki down,
-# wrong path, rejected credentials) the app writes one line to stderr naming
-# the Loki origin, the reason and how many events were dropped, at most once
-# every five minutes per reason; the password never appears in it. Leave all
-# three unset and logs stay on stdout for the Docker log driver to rotate.
+# private addresses and internal hostnames included; only link-local,
+# cloud-metadata and the unspecified address (0.0.0.0, ::) are refused. The
+# username/password pair is only needed when your Loki sits behind basic
+# auth. When a push fails (Loki down, wrong path, rejected credentials) the
+# app writes one line to stderr naming the Loki origin, the reason and how
+# many events were dropped, at most once every five minutes per reason; the
+# password never appears in it. Leave all three unset and logs stay on stdout
+# for the Docker log driver to rotate.
 # LOKI_ENDPOINT=""
 # LOKI_USERNAME=""
 # LOKI_PASSWORD=""