diff --git a/CLAUDE.md b/CLAUDE.md
index 28c2338..30d3511 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -88,7 +88,11 @@ internal/storage/    storage observer + durable ids + role/claim classifiers + S
 ## Demo host (for live tests)
 
 Node **`demo-felhom`**, API `https://192.168.0.162:8006`. SSH alias `felhom-pve` (root@pam) —
-available to CC as plain `ssh felhom-pve`. The agent pins the served leaf cert — verify the
+available to CC as plain `ssh felhom-pve`. A **second demo node `demo-hp`** (HP t740, agent 0.93.0,
+`ssh demo-hp` — no baked key; break-glass root via hub `host_recovery/demo-hp-bb76ea` + `sshpass`) is
+the **designated drill+build VM host** per the 2026-07-25 operator ruling — **but no drill VM is
+provisioned there yet** (the drill `drill.qcow2` still lives on DooPlex, powered off). Both nodes +
+the break-glass recipe: `felhom.eu/documentation/operations/nodes.md`. The agent pins the served leaf cert — verify the
 fingerprint still matches before a live run. Selftest modes (run locally on DooPlex, pointed at the
 demo API): `--selftest[=read|task|hub|storage|backup|restore-test|pbs-verify]`; no flag = the daemon.