diff --git a/auth/configuration.mdx b/auth/configuration.mdx
index 229dc13..e02d694 100644
--- a/auth/configuration.mdx
+++ b/auth/configuration.mdx
@@ -66,9 +66,9 @@ Pin the auth flow to a specific [proxy](/proxies/overview) so logins, health che
 
 How stable the exit IP is depends on the proxy type:
 
-- **[ISP](/proxies/isp)** and **[datacenter](/proxies/datacenter)** proxies provide a static exit IP that stays consistent across all connections.
+- **[ISP](/proxies/isp)** and **[datacenter](/proxies/datacenter)** proxies provide a stable exit IP within a single session, but Kernel does not guarantee the same IP across sessions. Sites with adaptive auth that trigger a step-up challenge (one-time code, device verification) when the client IP changes may flag the IP shift between the initial login and a subsequent health check or reauth.
 - **[Residential](/proxies/residential)** proxies rotate IPs per connection — use them when you need legitimacy from a real ISP pool but can tolerate IP changes.
-- **[Custom (BYO)](/proxies/custom)** proxies route through whatever you point them at, so this is the right pick if you need a truly static IP under your own control (e.g. an allowlisted egress your security team owns).
+- **[Custom (BYO)](/proxies/custom)** proxies route through whatever you point them at, so this is the right pick if you need a truly static IP that persists across the initial login and every subsequent health check and reauth (e.g. an allowlisted egress your security team owns).
 
 Create a proxy first, then attach it to the connection:
 
diff --git a/proxies/datacenter.mdx b/proxies/datacenter.mdx
index ec7249b..21a9a96 100644
--- a/proxies/datacenter.mdx
+++ b/proxies/datacenter.mdx
@@ -6,7 +6,9 @@ Datacenter proxies use IP addresses assigned from datacenter servers to route yo
 
 ## IP Rotation Behavior
 
-Datacenter proxies provide a **static exit IP** — the same IP address is used for all connections throughout the lifetime of the proxy. Every tab, request, and reconnection within a browser session exits through the same IP.
+Datacenter proxies provide a **stable exit IP within a single browser session** — every tab, request, and reconnection inside that session exits through the same IP, and it does not rotate mid-session (unlike residential).
+
+For cross-session IP stability (e.g. IP allowlists or [managed auth](/auth/overview) health checks), see [IP rotation behavior across proxy types](/proxies/overview).
 
 ## Configuration
 
diff --git a/proxies/isp.mdx b/proxies/isp.mdx
index 7b9393f..94bc2f5 100644
--- a/proxies/isp.mdx
+++ b/proxies/isp.mdx
@@ -6,7 +6,9 @@ ISP (Internet Service Provider) proxies combine the speed of datacenter proxies
 
 ## IP Rotation Behavior
 
-ISP proxies provide a **static exit IP** — the same IP address is used for all connections throughout the lifetime of the proxy. Every tab, request, and reconnection within a browser session exits through the same IP. This makes ISP proxies ideal for session-based workflows, login flows, and any use case where a consistent IP is important.
+ISP proxies provide a **stable exit IP within a single browser session** — every tab, request, and reconnection inside that session exits through the same IP, and it does not rotate mid-session (unlike residential).
+
+For cross-session IP stability (e.g. IP allowlists or [managed auth](/auth/overview) health checks), see [IP rotation behavior across proxy types](/proxies/overview).
 
 ## Configuration
 
diff --git a/proxies/overview.mdx b/proxies/overview.mdx
index 5299d5f..52a4dee 100644
--- a/proxies/overview.mdx
+++ b/proxies/overview.mdx
@@ -16,7 +16,9 @@ Kernel supports four types of proxies:
 Datacenter has the fastest speed, while residential is least detectable. ISP is a balance between the two options, with less-flexible geotargeting. Kernel recommends to use the first option in the list that works for your use case.
 
 <Info>
-Datacenter and ISP proxies provide a **stable exit IP** that stays consistent across all connections. Residential proxies use **rotating exit IPs** that may change per connection — see [Residential Proxies](/proxies/residential#ip-rotation-behavior) for details.
+Datacenter and ISP proxies provide a **stable exit IP within a single browser session** — the IP does not rotate mid-session. Across separate sessions, however, Kernel does not guarantee the same exit IP. If you need a truly static IP that persists across every session (for example, an IP allowlist or a [managed auth](/auth/overview) connection whose health checks must egress from a single IP), use a [custom (BYO) proxy](/proxies/custom) pointed at infrastructure you control.
+
+Residential proxies use **rotating exit IPs** that may change per connection — see [Residential Proxies](/proxies/residential#ip-rotation-behavior) for details.
 </Info>
 
 ## Create a proxy