diff --git a/nix/module-eval/bao-grants.nix b/nix/module-eval/bao-grants.nix
index 9362da1e..92c5650d 100644
--- a/nix/module-eval/bao-grants.nix
+++ b/nix/module-eval/bao-grants.nix
@@ -169,7 +169,7 @@ let
     _: u: (u.environment.BAO_CLIENT_CERT or null) == granterCertFile
   ) baoGrantWithConsumers.systemd.services;
 
-  # The seventeen units that write a `swarm-*` grant, by name, for the discovery
+  # The eighteen units that write a `swarm-*` grant, by name, for the discovery
   # control below.
   grantingUnitNames = [
     "swarm-bao-controller-policy"
@@ -942,24 +942,24 @@ let
     }
     {
       # A store host without the granter's pair writes its grants some other
-      # way, so none of the seventeen units may exist. Without this arm
+      # way, so none of the eighteen units may exist. Without this arm
       # `lib.mkIf haveGranter` could be dropped from any of them and every other
       # case here would still pass.
-      name = "without the granter's pair none of the seventeen granting units render";
+      name = "without the granter's pair none of the eighteen granting units render";
       ok =
         let
           s = baoGranterOptOut.systemd.services;
         in
         lib.all (unit: !(s ? ${unit})) (grantingUnitNames ++ [ "swarm-bao-granter-role" ])
-        # The control: the same store with the pair renders all seventeen.
+        # The control: the same store with the pair renders all eighteen.
         && lib.all (unit: baoGrantHere.systemd.services ? ${unit}) grantingUnitNames;
     }
     {
-      # 🩸 What replaced the silent skip. With no bootstrap token the seventeen still
+      # 🩸 What replaced the silent skip. With no bootstrap token the eighteen still
       # render, and a refused granter fails them with the step that fixes it.
       # A store host that never named a token is told to name one, since the
       # unit that sets the granter up renders only where it has.
-      name = "a store host without a bootstrap token renders the seventeen, each failing loudly with the one-time step";
+      name = "a store host without a bootstrap token renders the eighteen, each failing loudly with the one-time step";
       ok =
         let
           s = baoGranterNoToken.systemd.services;
@@ -1774,8 +1774,8 @@ let
     }
     {
       # What makes the case above mean something: discovery by the granter's
-      # certificate reaches all seventeen units, and each yields calls.
-      name = "the granter-policy check sees all seventeen granting units, and parses calls from each";
+      # certificate reaches all eighteen units, and each yields calls.
+      name = "the granter-policy check sees all eighteen granting units, and parses calls from each";
       ok =
         lib.sort lib.lessThan (lib.attrNames granterUnits) == lib.sort lib.lessThan grantingUnitNames
         && lib.all (u: baoCalls u.script != [ ]) (lib.attrValues granterUnits)