diff --git a/internal/config/config.go b/internal/config/config.go
index e5b2e57..ea15bf7 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -844,12 +844,6 @@ func getStringSlice(sc *smartconfig.Config) []string {
 	return nil
 }
 
-// parseCIDRList parses the value of the named config key into CIDR
-// prefixes, or returns nil if the key is omitted. It accepts a YAML list
-// of strings or a comma-separated string. An explicitly null value, a
-// wrong type, an empty entry, a non-string entry, or an unparseable CIDR
-// aborts startup naming the key and the offending value; the default
-// (an empty list) applies only to an omitted key.
 // defaultTrustedProxies returns the trusted_proxies default: the three RFC
 // 1918 private ranges. pixa is always deployed behind a TLS-terminating
 // reverse proxy, which in practice sits on a private network, so its
@@ -865,6 +859,12 @@ func defaultTrustedProxies() []netip.Prefix {
 	}
 }
 
+// parseCIDRList parses the value of the named config key into CIDR
+// prefixes, or returns nil if the key is omitted. It accepts a YAML list
+// of strings or a comma-separated string. An explicitly null value, a
+// wrong type, an empty entry, a non-string entry, or an unparseable CIDR
+// aborts startup naming the key and the offending value; the default
+// (an empty list) applies only to an omitted key.
 func parseCIDRList(sc *smartconfig.Config, key string) ([]netip.Prefix, error) {
 	if sc == nil {
 		return nil, nil