diff --git a/docs/cli/dsh.md b/docs/cli/dsh.md
index 274bfbd26f..72ccad9a22 100644
--- a/docs/cli/dsh.md
+++ b/docs/cli/dsh.md
@@ -90,8 +90,8 @@ run to its 900 s timeout. The profile denied the macOS resolver's configuration
 service, and node's DNS resolver, which dsh builds as it loads, can block
 forever on that denial. The profile now admits that one service, which returns
 configuration only and opens no network route of its own, so resolution fails
-fast. Use a
-CLI release that carries this fix before running a seat confined.
+fast. Confined mode works from CLI 0.1.196. A live confined turn on 2026-10-28
+replied in about 35 s, and requests to hosts outside the allowlist were refused.
 
 A seat that declares exactly this, and nothing else under `sandbox`, runs
 confined: