diff --git a/docs/2-handbook/swarm/services.md b/docs/2-handbook/swarm/services.md
index 72093f474..e7f1efddc 100644
--- a/docs/2-handbook/swarm/services.md
+++ b/docs/2-handbook/swarm/services.md
@@ -98,29 +98,31 @@ that service, not here.
 ## Services
 
 An operator who isn't spreading the swarm over more than one host can skip most of
-this page: `singleHostSwarm` runs every service below with no further
-setting. The table says what each one does and where its option and its
-section are. Only the **builder** and the **CI runner** cost real resources
-(they build and run pull-request code), so those are the two worth a look
-before you switch them on.
+this page: `singleHostSwarm` turns on the shared services below, with two
+exceptions. The **CI runner** stays off until you set `deploy.ci-runner.enable`,
+and the **builder** and **binary cache** come on only where the host has their
+store identities. The table says what each one does and where its option and
+its section are. The builder and the CI runner are the two that cost real
+resources (they build and run pull-request code), so they're the two worth a
+look before you switch them on.
 
-| Service | What it does | Option | Details |
-| --- | --- | --- | --- |
-| Forge | Holds the meta flake and every agent's config repo. | `deploy.forgejo.enable` | [forge.md](forge.md) |
-| Matrix | The chat homeserver agents and the operator talk over. | `deploy.matrix.enable` | [matrix.md](matrix.md) |
-| Secret store | Keeps the swarm's credentials. | `deploy.bao.enable` | [credentials.md](credentials.md) |
-| Queue | Carries hive status and swarm events. | `deploy.nats.enable` | [Deployment shapes](#deployment-shapes) |
-| SSO | One login for the operator and the agents. | `deploy.authelia.enable` | [SSO](#sso-authelia) |
-| Metrics | Stores telemetry and shows it in Grafana. | `deploy.victoriametrics.enable`, `deploy.grafana.enable` | [Metrics](#metrics-victoriametrics--grafana) |
-| Logs | Stores every journal for search in Grafana. | `deploy.victorialogs.enable` | [Logs](#logs-victorialogs) |
-| Telemetry collector | Routes metrics and logs to the stores and an optional upstream. | `deploy.swarm-otel.enable` | [Telemetry collector](#telemetry-collector-otel) |
-| CI runner | Runs Forgejo Actions for pull requests. Heavy. | `deploy.ci-runner.enable` | [CI runner](#ci-runner) |
-| Builder | Evaluates and builds agent config PRs. Heavy. | `deploy.builder.enable` | [Builder](#builder) |
-| Binary cache | Serves built closures to the hives. | `deploy.attic.enable` | [Binary cache](#binary-cache) |
-| CI metrics | Records CI run times in the metrics store. | `deploy.ci-metrics.enable` | [CI metrics](#ci-metrics) |
-| Review classifier | Checks PRs against a repo's review rules. | `deploy.review-classifier.enable` | [Review classifier](#review-classifier) |
-| Claude login minter | Runs the **log in** button on an agent's card. | `deploy.claude-login.enable` | [Claude login minter](#claude-login-minter) |
-| Notification router | Turns forge events into notifications for agents. | `deploy.notify-router.enable` | [Notification router](#notification-router) |
+| Service             | What it does                                                    | Option                                                   | Details                                          |
+| ------------------- | --------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------ |
+| Forge               | Holds the meta flake and every agent's config repo.             | `deploy.forgejo.enable`                                  | [forge.md](forge.md)                             |
+| Matrix              | The chat homeserver agents and the operator talk over.          | `deploy.matrix.enable`                                   | [matrix.md](matrix.md)                           |
+| Secret store        | Keeps the swarm's credentials.                                  | `deploy.bao.enable`                                      | [credentials.md](credentials.md)                 |
+| Queue               | Carries hive status and swarm events.                           | `deploy.nats.enable`                                     | [Deployment shapes](#deployment-shapes)          |
+| SSO                 | One login for the operator and the agents.                      | `deploy.authelia.enable`                                 | [SSO](#sso-authelia)                             |
+| Metrics             | Stores telemetry and shows it in Grafana.                       | `deploy.victoriametrics.enable`, `deploy.grafana.enable` | [Metrics](#metrics-victoriametrics--grafana)     |
+| Logs                | Stores every journal for search in Grafana.                     | `deploy.victorialogs.enable`                             | [Logs](#logs-victorialogs)                       |
+| Telemetry collector | Routes metrics and logs to the stores and an optional upstream. | `deploy.swarm-otel.enable`                               | [Telemetry collector](#telemetry-collector-otel) |
+| CI runner           | Runs Forgejo Actions for pull requests. Heavy.                  | `deploy.ci-runner.enable`                                | [CI runner](#ci-runner)                          |
+| Builder             | Evaluates and builds agent config PRs. Heavy.                   | `deploy.builder.enable`                                  | [Builder](#builder)                              |
+| Binary cache        | Serves built closures to the hives.                             | `deploy.attic.enable`                                    | [Binary cache](#binary-cache)                    |
+| CI metrics          | Records CI run times in the metrics store.                      | `deploy.ci-metrics.enable`                               | [CI metrics](#ci-metrics)                        |
+| Review classifier   | Checks PRs against a repo's review rules.                       | `deploy.review-classifier.enable`                        | [Review classifier](#review-classifier)          |
+| Claude login minter | Runs the **log in** button on an agent's card.                  | `deploy.claude-login.enable`                             | [Claude login minter](#claude-login-minter)      |
+| Notification router | Turns forge events into notifications for agents.               | `deploy.notify-router.enable`                            | [Notification router](#notification-router)      |
 
 ### SSO (authelia)