diff --git a/docker/telemetry/xrpld-telemetry-mainnet.cfg b/docker/telemetry/xrpld-telemetry-mainnet.cfg
index 28ebce9567..720c9a1b6b 100644
--- a/docker/telemetry/xrpld-telemetry-mainnet.cfg
+++ b/docker/telemetry/xrpld-telemetry-mainnet.cfg
@@ -11,11 +11,15 @@
 #   2. Run xrpld:
 #        ./xrpld --conf docker/telemetry/xrpld-telemetry-mainnet.cfg
 #   3. Wait for sync (server_state=full), then exercise workflows:
-#        curl -s http://localhost:5005 -d '{"method":"server_info"}'
+#        curl -s http://localhost:5015 -d '{"method":"server_info"}'
 #   4. View traces in Grafana Explore -> Tempo: http://localhost:3000
 
 # --- Server ports -----------------------------------------------------------
 
+# Ports are offset by +10 from the devnet config (xrpld-telemetry.cfg) so both
+# nodes can run at the same time. They are host processes sharing one network
+# namespace, so identical ports would leave the second node unable to bind.
+
 [server]
 port_rpc_admin_local
 port_ws_admin_local
@@ -23,24 +27,30 @@ port_ws_public
 port_peer
 
 [port_rpc_admin_local]
-port = 5005
+port = 5015
 ip = 127.0.0.1
 admin = 127.0.0.1
 protocol = http
 
 [port_ws_admin_local]
-port = 6006
+port = 6016
 ip = 127.0.0.1
 admin = 127.0.0.1
 protocol = ws
 
+# Bound to loopback: this port has no `admin` key, so every caller resolves to
+# Role::GUEST. Every workflow documented for this config is driven over the two
+# admin ports above, which also serve WebSocket, and this node follows Mainnet, so
+# there is no reason to accept off-host clients.
 [port_ws_public]
-port = 6005
-ip = 0.0.0.0
+port = 6015
+ip = 127.0.0.1
 protocol = ws
 
+# Stays on all interfaces: this is the peer-protocol listener, and binding it to
+# loopback would stop inbound overlay connections.
 [port_peer]
-port = 51235
+port = 51245
 ip = 0.0.0.0
 protocol = peer
 
@@ -73,21 +83,29 @@ validators-mainnet.txt
 [path_search_max]
 10
 
-# --- Signing (allows sign/sign_for RPC for test tx submission) --------------
+# --- Signing ----------------------------------------------------------------
 
-[signing_support]
-true
+# [signing_support] is deliberately omitted (it defaults to false). It is only
+# consulted for non-admin callers, and every signing path in this repo already
+# runs as admin over the loopback admin ports above, so enabling it would add
+# nothing except exposing sign/sign_for/channel_authorize to guests on a node
+# that follows Mainnet. Upstream also deprecates these commands.
 
 # --- Database ---------------------------------------------------------------
 
+# Paths carry the network name so this node never shares a store with the devnet
+# config. Both are relative to the working directory (the repo root, per the
+# usage note above), so an unqualified `data/` would have the two nodes opening
+# the same NuDB and the same SQLite ledger databases — including the case where
+# they run one after the other rather than concurrently.
 [node_db]
 type=NuDB
-path=docker/telemetry/data/nudb
+path=docker/telemetry/data/mainnet/nudb
 online_delete=2000
 advisory_delete=0
 
 [database_path]
-docker/telemetry/data
+docker/telemetry/data/mainnet
 
 [ledger_history]
 1000