diff --git a/net/common.sh b/net/common.sh
index fbe534576a..8e46adb72e 100644
--- a/net/common.sh
+++ b/net/common.sh
@@ -69,6 +69,7 @@ loadConfigFile() {
     entrypointIp=${validatorIpList[0]}
   else
     entrypointIp=${validatorIpListPrivate[0]}
+    maybeAllowPrivateAddr='--allow-private-addr'
   fi
 
   buildSshOptions
diff --git a/net/net.sh b/net/net.sh
index 9bb5378604..4f50efe715 100755
--- a/net/net.sh
+++ b/net/net.sh
@@ -901,6 +901,8 @@ while [[ -n $1 ]]; do
       extraPrimordialStakes=$2
       shift 2
     elif [[ $1 = --allow-private-addr ]]; then
+      # May also be added by loadConfigFile if 'gce.sh create' was invoked
+      # without -P.
       maybeAllowPrivateAddr="$1"
       shift 1
     else