diff --git a/Dockerfile b/Dockerfile
index c55220a..7d39d8a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,6 +10,17 @@ RUN set -eux; \
 
 WORKDIR /opt/drupal
 
+# NOTE(3wc): drutopia/drutopia_template currently references out-of-date URLs,
+# so we download composer.{json,lock} from drutopia_platform/build_source
+# instead.
+#
+# additionally, gitlab doesn't support cloning anonymously over SSH (maybe they
+# can pick up more work with border cops to be able to implement that 5-year-old "feature
+# request"[0] 🙄) so we need to switch to HTTPS URIs; in theory we could do this
+# selectively for gitlab, but doing it across the board means not needing to run
+# ssh-keyscan, or install an SSH client in the image.
+# 
+# [0]: https://gitlab.com/gitlab-org/gitlab/-/issues/24108
 RUN set -eux; \
 	export COMPOSER_HOME="$(mktemp -d)"; \
 	wget https://gitlab.com/drutopia-platform/build_source/-/raw/master/composer.json; \