diff --git a/plugins/computers/frontend/views/AccessProtocolsList.vue b/plugins/computers/frontend/views/AccessProtocolsList.vue
index 016b9675..13711685 100644
--- a/plugins/computers/frontend/views/AccessProtocolsList.vue
+++ b/plugins/computers/frontend/views/AccessProtocolsList.vue
@@ -69,7 +69,7 @@
           </label>
           <label class="field">
             <span>Link template</span>
-            <input v-model="form.linktemplate" type="text" maxlength="255" placeholder="vnc://{host}:{port}" />
+            <input v-model="form.linktemplate" type="text" maxlength="255" placeholder="scheme://{host}:{port}" />
             <small class="muted">Placeholders: <code>{host}</code>, <code>{port}</code>, <code>{scheme}</code></small>
           </label>
           <label class="field checkbox">
diff --git a/plugins/computers/plugin.py b/plugins/computers/plugin.py
index 3e6ed2ab..30863bff 100644
--- a/plugins/computers/plugin.py
+++ b/plugins/computers/plugin.py
@@ -2020,9 +2020,15 @@ class ComputersPlugin(BasePlugin):
         KNOWN GAP, tracked separately. The computer serializer is
         BaseModel.to_dict(), so it publishes every column - serialnumber, the
         Azure device and object ids - and the detail route resolves
-        accessmethods into working rdp:// and vnc:// links plus the full
-        Communication row. A guest granted this gets all of it, on the LIST
-        route as well, so it is one request rather than one per asset.
+        accessmethods into launch links, each built from that protocol's own
+        linktemplate, plus the full Communication row. A guest granted this
+        gets all of it, on the LIST route as well, so it is one request rather
+        than one per asset.
+
+        Do not name schemes here. The templates are site-editable rows in
+        accessprotocols, so what a link looks like is data, not a constant -
+        the shipped VNC row is com.realvnc.vncviewer.connect://, not vnc://,
+        and an earlier version of this docstring said otherwise for months.
 
         The fix is a field allowlist on Computer.to_dict() plus suppressing the
         resolved links unless the caller holds a remote-access permission. Do