diff --git a/pkg/runner/config.go b/pkg/runner/config.go
index 434575ba99..666a2f4994 100644
--- a/pkg/runner/config.go
+++ b/pkg/runner/config.go
@@ -404,6 +404,14 @@ func ReadJSON(r io.Reader) (*RunConfig, error) {
 
 // degradeNetworkIsolation drops network isolation from a loaded config when its
 // resolved network mode cannot enforce it, so status/list reflect reality.
+//
+// ReadJSON is reached from read-only paths (thv list, status, export, API GETs)
+// as well as deploy. The "none" case logs at DEBUG since it's merely redundant
+// (already maximally confined) and would otherwise fire on every read of a
+// static, already-known condition. The host/custom case stays at WARN even on
+// read paths: it means the user's --isolate-network request is being silently
+// ignored, which they should keep seeing until they either drop the flag or
+// switch network modes. See #5775.
 func degradeNetworkIsolation(config *RunConfig) {
 	if !config.IsolateNetwork {
 		return
diff --git a/pkg/runner/config_builder.go b/pkg/runner/config_builder.go
index a6d48ff1dd..df5a946759 100644
--- a/pkg/runner/config_builder.go
+++ b/pkg/runner/config_builder.go
@@ -1255,11 +1255,15 @@ func (b *runConfigBuilder) reconcileNetworkIsolation() error {
 
 	// host (or other non-bridge) is less restrictive than isolation, so dropping
 	// it reduces confinement. Fail fast when it was explicitly requested.
+	//
+	// The mode may come from --permission-profile rather than --network, so the
+	// message names the resolved mode instead of assuming a flag the user may
+	// never have passed. See #5794 review discussion.
 	if b.isolateNetworkExplicit {
 		return fmt.Errorf(
-			"network isolation cannot be enforced with --network %s: "+
-				"drop --network %s to keep enforced isolation, or pass --isolate-network=false to keep %s networking",
-			mode, mode, mode)
+			"network isolation cannot be enforced with the resolved network mode %q: "+
+				"use a bridge network mode to keep enforced isolation, or pass --isolate-network=false to keep %q networking",
+			mode, mode)
 	}
 
 	c.IsolateNetwork = false
diff --git a/pkg/runner/config_builder_test.go b/pkg/runner/config_builder_test.go
index cbced11fee..ea7b107efa 100644
--- a/pkg/runner/config_builder_test.go
+++ b/pkg/runner/config_builder_test.go
@@ -1707,9 +1707,11 @@ func TestRunConfigBuilder_NetworkIsolationReconciliation(t *testing.T) {
 
 			if tt.expectError {
 				require.Error(t, err, "expected build to fail fast")
-				// The error must name both ways out.
-				assert.Contains(t, err.Error(), "drop --network "+tt.networkMode,
-					"error should offer dropping the network mode")
+				// The error must name the resolved mode (not assume it came from
+				// --network, since it may have come from --permission-profile)
+				// and both ways out.
+				assert.Contains(t, err.Error(), `"`+tt.networkMode+`"`,
+					"error should name the resolved network mode")
 				assert.Contains(t, err.Error(), "pass --isolate-network=false",
 					"error should offer disabling isolation")
 				return