diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index e8f684ff..c25cf13a 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -920,14 +920,12 @@ in
             };
             environment = {
               SWARM_AUTHELIA_BRIDGE_BIND = "127.0.0.1:${toString cfg.bridgePort}";
-              # Own canonical store, alongside authelia's own state —
-              # NOT `swarm-controller`'s state dir: the two processes
-              # aren't guaranteed to be on the same host, and this store
-              # has to live wherever its writer (this bridge) does. See
-              # `swarm-authelia-bridge/README.md`'s "known limitation"
-              # section for the resulting `swarmctl`-owns-a-second-store
-              # seam.
-              SWARM_AUTHELIA_BRIDGE_STORE = "${stateDir}/swarm-authelia-bridge-users.json";
+              # ONE file, and this is it. The bridge used to carry a
+              # second, private `…-users.json` it treated as canonical
+              # while writing `users.yml` as a rendering of it — two
+              # canonical stores for one physical file, which is what
+              # made `swarm agent create` refuse to start on a hive whose
+              # `users.yml` already held users.
               SWARM_AUTHELIA_BRIDGE_USERS_FILE = cfg.usersFile;
               # The CONFIGURED authelia, not whatever is on `PATH`: the
               # argon2 parameters baked into a hash have to match the