diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 7cb4b7c8..3c3d3965 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -967,7 +967,29 @@ in
               server.address = "tcp://127.0.0.1:${toString cfg.port}";
               log.level = "info";
 
-              authentication_backend.file.path = cfg.usersFile;
+              # Authelia reads this file once, at STARTUP. `watch` makes it
+              # re-read on change, and that is load-bearing rather than a
+              # convenience.
+              #
+              # `swarm-authelia-bridge` writes this file to create agent
+              # identities and **cannot** restart authelia: running
+              # unprivileged inside the container is the whole reason it is
+              # allowed to write the file at all, so "restart the unit" is
+              # exactly the privilege it was designed not to hold. Without
+              # `watch` every identity it creates is real on disk and
+              # invisible to the running authelia until something unrelated
+              # bounces the unit.
+              #
+              # `swarmctl` does restart authelia after writing — but that is
+              # a `systemctl -M` shellout that can fail, and when it did the
+              # symptom was a login refused for a user whose record was
+              # already correct on disk, with nothing implicating the
+              # reload. This setting is what makes correctness stop
+              # depending on that restart succeeding.
+              authentication_backend.file = {
+                path = cfg.usersFile;
+                watch = true;
+              };
 
               # ⚠️ `one_factor` as the DEFAULT means "any authenticated
               # user", which is authentication, not authorisation. The