diff --git a/docs/swarm/bao.md b/docs/swarm/bao.md
index 37fda90b..e5b41f13 100644
--- a/docs/swarm/bao.md
+++ b/docs/swarm/bao.md
@@ -45,8 +45,8 @@ refuses the token (expired, revoked, or missing the `bao-bootstrap` policy)
 makes it exit 4 and stay `failed` with the one-time step in its log; mint a
 fresh token or remove the file, then restart it. If the granter's own
 certificate login already works, the unit logs that the bootstrap token isn't
-needed and exits 0, so a stale file is harmless. A successful run deletes the
-token file.
+needed, deletes the dead token file and exits 0, so a stale file is harmless
+and the unit runs once. A successful run deletes the token file too.
 
 After that, a new or changed `swarm-*` grant needs no operator step: the unit
 that writes it changes, and the deploy restarts it. A root step comes back only
diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 59516aee..93a48bcb 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -3186,11 +3186,13 @@ in
               # a host that finished bootstrap and kept the file. The
               # granter's own login is the proof. A fresh token still takes
               # the full path below, since the granter cannot read back its
-              # own policy to compare it.
+              # own policy to compare it. The refused token is dead,
+              # so it is deleted here and the unit does not start again.
               if BAO_CLIENT_CERT=${lib.escapeShellArg baoDeploy.granterClientCertFile} \
                 BAO_CLIENT_KEY=${lib.escapeShellArg baoDeploy.granterClientKeyFile} \
                 bao login -method=cert -token-only >/dev/null 2>&1; then
                 echo "granter role already in place; bootstrap token not needed"
+                rm -f ${lib.escapeShellArg baoDeploy.bootstrapTokenFile}
                 exit 0
               fi
               echo ${lib.escapeShellArg "the store is unsealed but refused the bootstrap token in ${baoDeploy.bootstrapTokenFile}: it has expired, been revoked, or does not carry the bao-bootstrap policy."} >&2
diff --git a/nix/module-eval/bao-grants.nix b/nix/module-eval/bao-grants.nix
index 4535ff27..9cc2fd8d 100644
--- a/nix/module-eval/bao-grants.nix
+++ b/nix/module-eval/bao-grants.nix
@@ -1125,8 +1125,10 @@ let
           noop = "granter role already in place; bootstrap token not needed";
           del = "rm -f /run/secrets/bao-bootstrap.token";
           before = lib.head (lib.splitString "refused the bootstrap token" g);
+          noopBranch = lib.head (lib.splitString "exit 0" (lib.last (lib.splitString noop g)));
         in
         lib.hasInfix noop before
+        && lib.hasInfix del noopBranch
         && lib.hasInfix "bao login -method=cert -token-only" before
         && lib.hasInfix "BAO_CLIENT_CERT=" before
         && lib.hasInfix del g