diff --git a/frontend/docs/e2e.md b/frontend/docs/e2e.md
index a4f95159..ce19145c 100644
--- a/frontend/docs/e2e.md
+++ b/frontend/docs/e2e.md
@@ -114,7 +114,8 @@ Before the browser specs, a **schema-compat pre-flight**
 validates every frontend operation against it — a renamed or missing field
 fails once, readably, instead of as dozens of red specs (the deploy-skew class
 we hit manually). Run it anywhere: `E2E_BASE_URL=https://… node
-e2e/tools/schema-compat.mjs`.
+e2e/tools/schema-compat.mjs` (against the local self-signed Tier-2 stack,
+prefix `NODE_TLS_REJECT_UNAUTHORIZED=0`; a real stand has a valid cert).
 
 ## Trends and selective runs
 
diff --git a/frontend/e2e/tools/schema-compat.mjs b/frontend/e2e/tools/schema-compat.mjs
index 8606b5c8..db16eef7 100644
--- a/frontend/e2e/tools/schema-compat.mjs
+++ b/frontend/e2e/tools/schema-compat.mjs
@@ -27,9 +27,9 @@ if (!BASE_URL) {
     process.exit(2);
 }
 
-// Node rejects the stack's self-signed cert otherwise; the target is trusted by
-// virtue of being the URL we were told to check.
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+// A real stand has a valid cert. Only the local self-signed Tier-2 stack needs
+// TLS verification relaxed — the operator opts in for that with
+// `NODE_TLS_REJECT_UNAUTHORIZED=0 node …` in their own shell, never in code.
 
 // Despite the name, this file holds the frontend's operations (named queries /
 // mutations / subscriptions + fragments), not a schema.