diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 34676bda..e577a988 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -2056,9 +2056,20 @@ in
             # not arrived yet is a collector that says so and retries, not one
             # that quietly exports into a 401. The restart is what closes the
             # first-boot window the host unit's own comment describes.
+            #
+            # ⚠️ `Restart` is deliberately NOT set here, same as the sibling
+            # collector in ./swarm-otel.nix: nixpkgs' own
+            # services/monitoring/opentelemetry-collector.nix already defines it
+            # as `"always"` at the normal priority, so a second definition beside
+            # it is a conflict the module system refuses to resolve rather than a
+            # stricter policy. `"always"` is also the value we want — a forwarder
+            # that exits for any reason, clean or not, has stopped shipping the
+            # store's journal. Only `RestartSec` is ours: systemd's 100ms default
+            # would burn the unit's default start-rate limit while the host unit
+            # is still delivering the secret, leaving it failed rather than
+            # retrying.
             systemd.services.opentelemetry-collector.serviceConfig = {
               LoadCredential = [ "${forwarderCredentialId}:${forwarderSecretInContainer}" ];
-              Restart = "on-failure";
               RestartSec = 15;
             };
           };