diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index a4727fed..f43683e2 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -44,12 +44,48 @@ Every row below is read against one of these.
 | OIDC client secret, digest half | the same mint | `oidc-clients/<id>.digest` | authelia's own half; merged at runtime via `settingsFiles` |
 | authelia subject store | `swarmctl` | `users.json` (canonical) → `users.yml` (rendered) | `swarmctl`, on the host that runs authelia |
 | wireguard private key | **the operator** — `wg genkey` | whatever `swarm.wireguard.privateKeyFile` names | always operator-provided; nothing generates this for you |
+| queue auth-callout nkeys (user seed + account seed) | `swarm-nats-callout-keys` first-boot unit, when `nats.autoGenerateCallout` is set | `/var/lib/swarm-nats-callout/{callout-user,issuer}.seed`, `0600` | operator mints both with `nk` and names them in `nats.calloutUserSeedFile` / `nats.calloutIssuerSeedFile` |
 
 The three keys authelia mints for itself are generated in-container precisely
 because nothing outside that container ever reads them. **That is the test worth
 applying to any secret added here** — and the client secret's plaintext half is
 the one row that fails it, which is the entire reason a delivery step exists.
 
+### The queue's public keys are values, not paths
+
+`nats.calloutUserPublicKey` and `nats.calloutIssuerPublicKey` take a value
+rather than a file path, and that is not an exception to the rule at the top of
+this page. A public nkey is published to every client that connects; being
+widely known is its job. The matching **seeds** are the secrets, are named only
+as paths, and reach the callout responder and nothing else.
+
+`nats.autoGenerateCallout` mints both keypairs on the host before the queue
+starts. It is on by default only under `enableAllLocalDefaults` — the one
+topology where the queue, its responder and the operator are the same person. On
+every other topology, mint them yourself:
+
+```
+nk -gen user    > callout-user.seed     # the responder's own identity
+nk -gen account > issuer.seed           # signs the user JWTs it hands out
+nk -inkey callout-user.seed -pubout     # → calloutUserPublicKey
+nk -inkey issuer.seed       -pubout     # → calloutIssuerPublicKey
+```
+
+Keep both seeds at `0600` and name them in `calloutUserSeedFile` /
+`calloutIssuerSeedFile`. Possession of the **issuer** seed is the authority to
+admit anyone to the queue, so it belongs wherever the responder runs and nowhere
+else.
+
+A hive that sets neither the public keys nor `autoGenerateCallout` fails at
+eval, naming the option it wants. That is deliberate: a queue that started
+without them would accept `CONNECT {"user":"auth"}` from anyone sharing the
+host's network namespace, and nothing would look wrong until somebody connected.
+
+One consequence of the generated path worth knowing before you debug it: with
+`autoGenerateCallout` set, the queue's config is assembled at boot rather than at
+build time, so a malformed one surfaces when the container starts instead of
+when the system builds. The server names the offending file and refuses to run.
+
 ## Hive-level — one of each per hive
 
 | secret | generated by | lives at |