diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index 4d324944..d7af9c57 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -47,6 +47,7 @@ Every row below is read against one of these.
 | authelia OIDC issuer key (RSA) | same unit | `/var/lib/authelia-swarm/oidc-issuer.key` | same — relying parties verify against the **public** half at `/jwks.json` |
 | OIDC client secret, plaintext half | `authelia crypto hash generate --random` | `/var/lib/authelia-swarm/oidc-clients/<id>.secret` | operator provides the file and names it in whichever option reads it — `sso.clientSecretFile` for a service, `otel.clientSecretFile` for the hive's telemetry collector |
 | OIDC client secret, digest half | the same mint | `oidc-clients/<id>.digest` | authelia's own half; merged at runtime via `settingsFiles` |
+| the swarm collector's copy of its OIDC secret | `swarm-otel-oidc-secret.service` copies it from authelia's tree | `/var/lib/swarm-otel-oidc/<id>.secret` inside the `swarm-otel` container | n/a — this collector runs on the swarm's service host, beside authelia |
 | authelia subject store | `swarmctl` and `swarm-authelia-bridge` | `users.yml` — one file, read and written by both | `swarmctl`, on the host that runs authelia |
 | wireguard private key | **the operator** — `wg genkey` | whatever `swarm.wireguard.privateKeyFile` names | always operator-provided; nothing generates this for you |
 | queue auth-callout nkeys (user seed + account seed) | `swarm-nats-callout-keys` first-boot unit, when `nats.autoGenerateCallout` is set | `/var/lib/swarm-nats-callout/{callout-user,issuer}.seed`, `0600` | operator mints both with `nk` and names them in `nats.calloutUserSeedFile` / `nats.calloutIssuerSeedFile` |
@@ -56,12 +57,25 @@ because nothing outside that container ever reads them. **That is the test worth
 applying to any secret added here** — and the client secret's plaintext half is
 the one row that fails it, which is the entire reason a delivery step exists.
 
-One reader needs no delivery step: the **hive's telemetry collector**, which
-authenticates to the swarm's collector as its own hive. It is a host unit rather
-than a container, so on an all-local swarm it reads authelia's file where it
-lies (through `LoadCredential`) and no second copy is made. On any other
-topology it is an ordinary "operator provides the file" case — see
-`services.hyperhive.otel.clientSecretFile`.
+There are two telemetry collectors and they land on opposite sides of that test.
+
+The **hive's** collector needs no delivery step. It authenticates to the swarm's
+collector as its own hive, and it is a host unit rather than a container, so on
+an all-local swarm it reads authelia's file where it lies and no second copy is
+made. On any other topology it is an ordinary "operator provides the file"
+case — see `services.hyperhive.otel.clientSecretFile`.
+
+The **swarm's** collector does need one. It runs in a container, so its copy is
+placed by `swarm-otel-oidc-secret.service` and lands at
+`/var/lib/swarm-otel-oidc/<client-id>.secret` — the same shape as the forge and
+homeserver rows below, and for the same reason: the container that mints the
+secret is not the container that reads it.
+
+There is no operator-provided variant of that one, and that is a property of
+where it runs rather than an omission: the swarm's collector lives on the host
+that runs the swarm's services, which is the host that runs authelia. The copy
+is only made when authelia is enabled here and something published is being
+scraped; otherwise no secret is needed and none is placed.
 
 ### Minting the queue's callout nkeys