diff --git a/docs/setup.md b/docs/setup.md
index 8e333d5f..9af3819f 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -10,6 +10,12 @@ sequence. All `hivectl` commands below run as **root on the host** (not
 inside an agent container); the `request_*` steps run from ruth's own
 turn via the MCP tools.
 
+**Bringing up a hive that does not host its own swarm services?** Read
+[`swarm/secrets.md`](swarm/secrets.md) first. Everything below assumes
+each credential is generated where it is read, which is true on an
+all-local deploy and not otherwise — that page says which files an
+operator has to place, and where.
+
 ## Step-by-step
 
 ### 1 · Forge
diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index b04017ee..a4727fed 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -60,9 +60,10 @@ the one row that fails it, which is the entire reason a delivery step exists.
 | the forge's copy of its OIDC secret | `hive-forge-oidc-secret.service` copies it from authelia's tree | `/var/lib/forgejo-oidc/<id>.secret` inside the forge container |
 | the homeserver's copy of its OIDC secret | `hive-matrix-oidc-secret.service`, same shape | `/var/lib/tuwunel-oidc/<id>.secret`, handed to tuwunel through `LoadCredential` |
 
-Both delivery units wait for authelia's first boot to mint the secret, with a
-bound, and **fail loudly** rather than skipping. A silent skip produces a service
-whose login button always fails — a symptom several layers from its cause.
+Both delivery units wait for authelia's first boot to mint the secret — a
+bounded wait, 120s — and then **fail loudly** rather than skipping. A silent skip
+produces a service whose login button always fails, which is a symptom several
+layers from its cause.
 
 ## The constraint that decides where the root lives