diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 728bcfcd..b4ee8458 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -938,8 +938,8 @@ in
                 # its token file deleted to force a re-mint with the new
                 # scope.
                 #
-                # Token name carries a timestamp suffix rather than a fixed
-                # `swarm-controller-boot` — a real
+                # Token name carries a timestamp suffix rather than the
+                # fixed `swarm-controller-boot` this used to be — a real
                 # incident, not a hypothetical: deleting the token *file*
                 # (the remediation above) doesn't delete the token Forgejo
                 # already has under that name, so re-running this unit hit
diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix
index 8519b03e..49ee6d65 100644
--- a/nix/host-modules/hive-tls.nix
+++ b/nix/host-modules/hive-tls.nix
@@ -131,7 +131,7 @@ let
     # than a stale one — its own vhosts are covered by the hive leaf
     # above. Anywhere else it is expected: the leaf comes from the
     # secret store's `pki` mount now, not from a sub-CA that exists on
-    # one host in the swarm, so "this host cannot issue it" is not
+    # one host in the swarm, so "this host cannot issue it" is no longer
     # one of the answers.
     want_svc=${if localServiceDomains == [ ] then "0" else "1"}