diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index 8b78bd2a..56fd0be9 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -617,12 +617,14 @@ let
     }
     {
       # Both values come from ../container-modules/swarm-container.nix.
+      # Four of the 14 service containers share the host netns (hive-forge, bao,
+      # the queue, the log store) and ten have one of their own.
       name = "a service container on the host netns runs no firewall or resolvconf of its own";
       ok =
         let
           shared = lib.filter (c: !c.privateNetwork) (lib.attrValues serviceContainers);
         in
-        lib.length shared == 5
+        lib.length shared == 4
         && lib.all (
           c: !c.config.networking.firewall.enable && !c.config.networking.resolvconf.enable
         ) shared;