Update from support feedback: clarify Git integration network requirements

deploy/ghes.mdx

@@ -16,18 +16,24 @@ If you use a cloud-hosted GitHub instance, see the [GitHub](/deploy/github) page
 
 ### Network requirements
 
-#### Outbound connectivity
+The integration requires traffic in both directions between your GHES instance and Mintlify. Configure your firewall to allow both of the following connections.
 
-Your GitHub Enterprise Server must be able to reach:
-- Mintlify's API endpoints (https://leaves.mintlify.com)
-- Webhook receivers (port 443)
+#### Outbound: your GHES instance to Mintlify
 
-#### Firewall configuration
+Your GHES instance delivers webhook events to Mintlify over HTTPS (port 443) at `leaves.mintlify.com`.
 
-Allow the following outbound connections:
-- Connections from Mintlify's static IP: `54.242.90.151`
-- HTTPS (port 443) to Mintlify's service domains
-- DNS resolution for Mintlify's service domains
+- Allow outbound HTTPS (port 443) to `leaves.mintlify.com`. Allow this traffic by hostname. Mintlify does not publish a static IP address list for this endpoint, and its underlying IP addresses can change.
+- Ensure your GHES instance can resolve `leaves.mintlify.com` through DNS. If your servers use an internal DNS resolver, confirm that it resolves public hostnames.
+
+#### Inbound: Mintlify to your GHES instance
+
+Mintlify connects to your GHES instance over HTTPS (port 443) to call the GitHub API, report check run and deployment statuses, and read repository content. These connections originate from Mintlify's static egress IP address: `54.242.90.151`.
+
+If a firewall or IP allowlist restricts access to your GHES instance, allow inbound HTTPS (port 443) from `54.242.90.151`.
+
+<Note>
+  [Agent](/agent) runs clone and push from separate sandbox infrastructure that uses dynamic IP addresses by default. If your GHES instance enforces an IP allowlist, see [Fix agent runs blocked by an IP allow list](/help-center/agent-blocked-by-git-provider-ip-allow-list).
+</Note>
 
 ## Step 1: register the GitHub App
 

deploy/gitlab-self-hosted.mdx

@@ -21,6 +21,24 @@ Unlike gitlab.com, where Mintlify ships a single OAuth application that every cu
 - A Mintlify organization on the **Pro or Enterprise plan**.
 - A Mintlify organization that has the self-hosted GitLab feature enabled. Contact support if you don't see the **Self-hosted GitLab** section in your [Git settings](https://app.mintlify.com/settings/deployment/git-settings) dashboard page.
 
+## Network requirements
+
+The integration requires traffic in both directions between your GitLab instance and Mintlify.
+
+### Inbound: Mintlify to your GitLab instance
+
+Mintlify connects to your GitLab instance over HTTPS (port 443) to exchange OAuth tokens and call the GitLab API. These connections originate from Mintlify's static egress IP address: `54.242.90.151`.
+
+If a firewall or IP allowlist restricts access to your GitLab instance, allow inbound HTTPS (port 443) from `54.242.90.151`.
+
+<Note>
+  Automation runs clone and push from separate sandbox infrastructure that uses dynamic IP addresses by default. If your GitLab instance enforces an IP allowlist, see [Fix agent runs blocked by an IP allow list](/help-center/agent-blocked-by-git-provider-ip-allow-list).
+</Note>
+
+### Outbound: your GitLab instance to Mintlify
+
+Your GitLab instance delivers webhook events to Mintlify over HTTPS (port 443) at `app.mintlify.com`. Allow this traffic by hostname. Mintlify does not publish a static IP address list for this endpoint.
+
 ## Set up the connection
 
 <Steps>

docs.json

@@ -484,7 +484,8 @@
                   "help-center/style-card-icons-with-custom-css",
                   "help-center/can-i-rename-my-deployment-or-organization",
                   "help-center/tailwind-classes-not-applying-in-editor-preview",
-                  "help-center/agent-blocked-by-git-provider-ip-allow-list"
+                  "help-center/agent-blocked-by-git-provider-ip-allow-list",
+                  "help-center/ip-addresses-for-git-provider-allowlists"
                 ]
               }
             ]

help-center/ip-addresses-for-git-provider-allowlists.mdx

@@ -0,0 +1,25 @@
+---
+title: "What IP addresses does Mintlify connect to a Git provider from?"
+description: "Add Mintlify's static egress IP 54.242.90.151 to the allowlist for GitHub Enterprise Cloud, GitHub Enterprise Server, and self-hosted GitLab instances."
+keywords: ["egress IP", "IP allowlist", "firewall", "static IP", "GitHub Enterprise", "GHES", "self-hosted GitLab", "54.242.90.151"]
+---
+
+If your Git provider sits behind an IP allowlist or firewall, you need to allow the connections Mintlify makes to it. Mintlify's platform connects to Git providers over HTTPS (port 443) from a single static egress IP address:
+
+```text
+54.242.90.151
+```
+
+Add this IP address to your allowlist when:
+
+- Your GitHub Enterprise Cloud organization has an IP allowlist enabled. See [GitHub Enterprise with IP allowlists](/deploy/github#github-enterprise-with-ip-allowlists).
+- A firewall or IP allowlist restricts inbound access to your GitHub Enterprise Server instance. See the [GHES network requirements](/deploy/ghes#network-requirements).
+- A firewall or IP allowlist restricts inbound access to your self-hosted GitLab instance. See the [self-hosted GitLab network requirements](/deploy/gitlab-self-hosted#network-requirements).
+
+## Agent and automation runs
+
+[Agent](/agent) runs clone and push from separate sandbox infrastructure. That traffic uses dynamic IP addresses by default, so allowlisting `54.242.90.151` does not cover it. Mintlify support can route a deployment's agent Git traffic through the static IP on request. See [Fix agent runs blocked by an IP allow list](/help-center/agent-blocked-by-git-provider-ip-allow-list).
+
+## Traffic from your Git server to Mintlify
+
+Traffic in the other direction works differently. Your instance delivers webhook events to Mintlify hostnames such as `leaves.mintlify.com` and `app.mintlify.com`. Allow that outbound traffic by hostname. Mintlify does not publish a static IP address list for those endpoints, and their underlying IP addresses can change.