diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index d0d60eba..af1ed595 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -47,9 +47,9 @@ let
       exit 1
     fi
 
-    # Write in EnvironmentFile format: TOKEN=<value>
+    # Write in EnvironmentFile format: TOKEN=<value>.
+    # File is already 0600 (set by tmpfiles on boot).
     echo "TOKEN=$REG_TOKEN" > "$TOKEN_FILE"
-    chmod 600 "$TOKEN_FILE"
   '';
 in
 {
@@ -201,6 +201,12 @@ in
           # overwrites this placeholder with the real token before the runner
           # starts. On subsequent boots the placeholder is harmless because
           # the nixpkgs register step exits early when .runner already exists.
+          #
+          # Note: `f` doesn't create parent directories, but /run/hive-ci/
+          # is guaranteed to exist by the time container systemd starts:
+          # nspawn creates mount-point directories for all bindMounts before
+          # launching the container's init. So the dir is there when
+          # systemd-tmpfiles-setup.service runs.
           systemd.tmpfiles.rules = [
             "f /run/hive-ci/runner-token 0600 root root - TOKEN=placeholder"
           ];