diff --git a/AGENTS.md b/AGENTS.md
index 6b92641..806be5e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -301,6 +301,10 @@ Hard-won operational gotchas. One line each; keep them short and load-bearing.
   Pi-holes; use `tailscale status` peer IPs + the chokepoint env overrides
   (NETINFRA01_HOST/NETINFRA02_HOST, VM_IP) to reach hosts by Tailscale
   while names are unresolvable. Fix one node, verify, then the other.
+- **dhcpd + AppArmor:** on the netinfra pair, dhcpd can only read configs
+  under `/etc/dhcp/**` — staging a candidate config in /tmp fails dhcpd -t
+  with "Permission denied" even as root. Stage as /etc/dhcp/*.candidate,
+  test, then move into place.
 
 ## Questions (NON-NEGOTIABLE)