diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 761ee57d..96975e16 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -227,6 +227,11 @@ EOF
     exit 1
   fi
 
+  # TODO(e2e-replace-fixed-timeouts): genuine retry loop. This validates an
+  # external HTTP path (MetalLB-advertised LB IP -> in-tenant ingress ->
+  # backend pod) which is not visible to the Kubernetes API as a single
+  # condition, so kubectl wait cannot replace it. The 20x3s = 60s budget is
+  # capped with `lb_ok=false` then asserted below.
   lb_ok=false
   for i in $(seq 1 20); do
     echo "Attempt $i"
diff --git a/hack/e2e-install-cozystack.bats b/hack/e2e-install-cozystack.bats
index 2fe0dfbd..f2e7b42c 100644
--- a/hack/e2e-install-cozystack.bats
+++ b/hack/e2e-install-cozystack.bats
@@ -61,6 +61,11 @@ EOF
 
   # Wait until HelmReleases appear & reconcile them
   timeout 180 sh -ec 'until [ $(kubectl get hr -A --no-headers 2>/dev/null | wc -l) -gt 10 ]; do sleep 1; done'
+  # TODO(e2e-replace-fixed-timeouts): genuine sleep. The threshold of 10 is a
+  # heuristic for "enough HRs visible to start waiting"; the snapshot below
+  # uses whatever HRs have appeared by then. There is no objective k8s API
+  # signal for "all platform HRs have been emitted" without hard-coding the
+  # expected list, so the 5s pad lets a few late-arrivals join the snapshot.
   sleep 5
   kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n "$1" hr/"$2" &"} END {print "wait"}' | sh -ex
 
diff --git a/hack/e2e-post-install-prep.sh b/hack/e2e-post-install-prep.sh
index 7a6fc798..a5010503 100755
--- a/hack/e2e-post-install-prep.sh
+++ b/hack/e2e-post-install-prep.sh
@@ -18,6 +18,9 @@ echo "[post-install-prep] waiting for linstor-controller to be Available"
 kubectl wait deployment/linstor-controller -n cozy-linstor --timeout=5m --for=condition=available
 
 echo "[post-install-prep] waiting for 3 LINSTOR nodes Online"
+# TODO(e2e-replace-fixed-timeouts): genuine poll. LINSTOR node membership is
+# reported by the linstor binary inside the controller pod, not via a
+# Kubernetes API condition, so kubectl wait cannot subscribe to it.
 timeout 60 sh -ec 'until [ $(kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor node list | grep -c Online) -eq 3 ]; do sleep 1; done'
 
 echo "[post-install-prep] creating LINSTOR storage pools (parallel across nodes)"