enrollment keys are for initial registration (initial registration can include joining network(s) if the key was created with networks enabled) ... the enrollment key is not used by netclient after that.

thanks 🙏 I was confused because I have created a single-usage enrollment key, but the official network container kept failing after restart. I have found out that it's because on startup it runs

/root/netclient join $TOKEN_CMD

.