diff --git a/docs/deposit-transaction-builder.md b/docs/deposit-transaction-builder.md
index 875721f5..ea041cb6 100644
--- a/docs/deposit-transaction-builder.md
+++ b/docs/deposit-transaction-builder.md
@@ -35,6 +35,10 @@ Requires authentication via `x-user-id` header.
 - `network` (optional): Stellar network identifier
   - Values: `"testnet"` or `"mainnet"`
   - Default: `"testnet"`
+  - Must match `config.stellar.network`. `DepositController` rejects any other
+    value with `INVALID_NETWORK` before the transaction builder is invoked, so
+    a request for a network that differs from the server configuration fails
+    even if the identifier is otherwise well-formed.
 
 - `source_account` (optional): Custom source account for the transaction
   - Format: Valid Stellar public key (G... with 56 characters)
diff --git a/docs/network-configuration.md b/docs/network-configuration.md
index 7d394e6e..64cf4421 100644
--- a/docs/network-configuration.md
+++ b/docs/network-configuration.md
@@ -1,7 +1,7 @@
 # Stellar Network Configuration
 
 This backend supports two networks:
-- `testnet`
+- `testnet`
 - `mainnet`
 
 Use one active network per deployment to avoid mixing chain data.
@@ -36,7 +36,7 @@ STELLAR_TESTNET_SETTLEMENT_CONTRACT_ID=CC...TESTNET_SETTLEMENT
 STELLAR_MAINNET_HORIZON_URL=https://horizon.stellar.org
 SOROBAN_MAINNET_RPC_URL=https://soroban-mainnet.stellar.org
 STELLAR_MAINNET_VAULT_CONTRACT_ID=CC...MAINNET_VAULT
-STELLAR_MAINNET_SETTLEMENT_CONTRACT_ID=CC...MAINNET_SETTLEMENT
+STELLAR_MAINNET_SETTLEMENT_CONTRACT_ID=CB...MAINNET_SETTLEMENT
 ```
 
 ## Behavior Guarantees
@@ -49,10 +49,31 @@ STELLAR_MAINNET_SETTLEMENT_CONTRACT_ID=CC...MAINNET_SETTLEMENT
 - Remote Stellar endpoints must use `https://`; plain `http://` is only allowed for localhost-based development endpoints.
 - Stellar endpoint URLs must not include embedded credentials, query strings, or URL fragments.
 
+## Network Match Rules for Deposit Preparation
+
+The deposit flow enforces the active network at the controller layer. `DepositController` compares the `Network` field of the incoming `Post /api/vault/deposit/prepare` body against `config.stellar.network and rejects any mismatch before touching Horizon or Soroban.
+
+- Allowed values are the active network only (`testnet` or `mainnet`).
+- A mismatch returns HTTP 400 with an `INVALID_NETWORK` error code and a message identifying the expected network.
+- The controller also rejects requests whose vault has not been registered, surfacing a vault-not-found error instead of building a transaction.
+- Network and vault validation happen before fee estimation, so misconfigured clients fail fast and cheaply.
+
+## Fee and Timeout Environment Variables
+
+The deposit transaction builder derives fees and timebounds from environment variables rather than hard-coding them:
+
+| Variable | Purpose | Default |
+| --- | --- | --- |
+| `STELLAR_BASE_FEE` | Base fee (in strops) applied to the built transaction | Horizon default when unset |
+| `STELLAR_FEE_MULTIPLIER` | Multiplier applied on top of the simulated/base fee | `1` |
+| `STELLAR_TX_TIMEOUT_SECONDS` | Transaction timebound in seconds from the current ledger time | `300` |
+
+These values are read through the active network configuration, so changing them requires a restart of the service.
+
 ## Optional Aliases
 
 For contract IDs, these aliases are also accepted:
 - `SOROBAN_TESTNET_VAULT_CONTRACT_ID`
-- `SOROBAN_MAINNET_VAULT_CONTRACT_ID`
+- `SOROBAN_MAINNET_VAULT_CONTRACT_ID`
 - `SOROBAN_TESTNET_SETTLEMENT_CONTRACT_ID`
-- `SOROBAN_MAINNET_SETTLEMENT_CONTRACT_ID`
+- `SOROBAN_MAINNET_SETTLEMENT_CONTRACT_ID`