diff --git a/nix/module-eval/ci-metrics.nix b/nix/module-eval/ci-metrics.nix
index e40f7c4c..a6cddaf7 100644
--- a/nix/module-eval/ci-metrics.nix
+++ b/nix/module-eval/ci-metrics.nix
@@ -90,7 +90,7 @@ let
         && c.kind == "machine"
         && c.audience == [ clientId ]
         && lib.hasInfix "secret/swarm/services/${clientId}/oidc/client" (
-          allLocal.systemd.services.swarm-secret-publish.script
+          allLocal.containers.swarm-authelia.config.systemd.services.swarm-secret-publish.script
         );
     }
   ];
diff --git a/swarm-ci-metrics/src/main.rs b/swarm-ci-metrics/src/main.rs
index 9b1b1fc6..feb4b574 100644
--- a/swarm-ci-metrics/src/main.rs
+++ b/swarm-ci-metrics/src/main.rs
@@ -258,7 +258,7 @@ async fn client_secret(client_id: &str) -> Result<String> {
     match stored {
         Some(s) if !s.value.trim().is_empty() => Ok(s.value.trim().to_owned()),
         _ => bail!(
-            "nothing at {path}: swarm-secret-publish, on the host that runs authelia, has not \
+            "nothing at {path}: swarm-secret-publish, in authelia's container, has not \
              published this service's client secret"
         ),
     }