diff --git a/docs/development/build-guide.md b/docs/development/build-guide.md
index 6c09d8c5cd..5ade29f6a8 100644
--- a/docs/development/build-guide.md
+++ b/docs/development/build-guide.md
@@ -9,7 +9,7 @@ Two git submodules are pinned to known-good versions:
 | Submodule | Path | Pinned version |
 |-----------|------|----------------|
 | mkosi | `pxe/mkosi` | `v25` |
-| iPXE (secboot fork) | `pxe/ipxe/upstream` | `secboot-ioactive-20221109-302-gd7e58c5a8` |
+| iPXE (upstream) | `pxe/ipxe/upstream` | `v2.0.0-130-gbbd7821bd8` |
 
 To update a submodule to a newer version:
 
diff --git a/docs/playbooks/stuck_objects/network_connectivity.md b/docs/playbooks/stuck_objects/network_connectivity.md
index ec07404457..03ef230f8d 100644
--- a/docs/playbooks/stuck_objects/network_connectivity.md
+++ b/docs/playbooks/stuck_objects/network_connectivity.md
@@ -62,6 +62,12 @@ Common causes:
 | Request but no lease | no matching reservation or exhausted pool. |
 | Lease assigned but no progress | PXE/HTTP boot, scout, or API reachability failure. |
 
+A prior DHCPDECLINE can make Kea reject the correct address with a NAK
+because the lease is temporarily marked unavailable.
+nico-dhcp.config.kea.declineProbationPeriod now defaults to 900 seconds,
+instead of the kea default of 24 hours, limiting how long the address
+remains quarantined.
+
 ## PXE and HTTP Boot
 
 `nico-pxe` serves discovery images, iPXE scripts, cloud-init, kickstart, BFB