diff --git a/docs/deployment.md b/docs/deployment.md
index 5004b2d..719fd16 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -202,11 +202,14 @@ point release. Building straight against it fails on hash mismatches and, worse,
 package list by import-from-derivation — which would drag *evaluation* of this flake onto the
 network and let an OpenWrt feed rebuild break `check-system` for unrelated boxes.
 
-The `openwrt-feeds` input exists to stop that. It holds expanded per-package hashes, so every `.apk`
-is a plain pinned `fetchurl` and no import-from-derivation is involved. Its generated files run to
-hundreds of thousands of lines and are rewritten wholesale on each refresh, which is why they live
-in their own repository rather than here. Refresh the pin with `nix flake update openwrt-feeds`;
-adding a release or target means adding it to that repo's `pins` and regenerating there first.
+The `openwrt-feeds` input exists to stop that. It holds expanded per-package metadata and vendors
+the repository indexes themselves, so every `.apk` is a plain pinned `fetchurl`, image builds read
+the indexes from the flake rather than OpenWrt's mutable URLs, and no import-from-derivation is
+involved. Its generated files run to hundreds of thousands of lines and are rewritten wholesale on
+each refresh, which is why they live in their own repository rather than here. Regenerate and push
+that repository with `nix run .#update`, then refresh this flake's pin with
+`nix flake update openwrt-feeds`; adding a release or target means adding it to that repository's
+`pins` first.
 
 ## CI
 
diff --git a/flake.lock b/flake.lock
index 00bbc29..5347a3d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -941,11 +941,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787353688,
-        "narHash": "sha256-YDEm+ev3BpDS9Sq1ByVv0i5QQCE1yezpjWVhcNBBjCE=",
+        "lastModified": 1787522666,
+        "narHash": "sha256-Ev4X1HCx6aV4L5GtMQX9DJRgWQ7K914rT11nL7mIkmw=",
         "owner": "devplayer0",
         "repo": "openwrt-feeds",
-        "rev": "a30b2b5f83c7d1fffca2146453e8d5866b882da4",
+        "rev": "53720becf1e89473660e25107ae5d23bf1465621",
         "type": "github"
       },
       "original": {