diff --git a/nix/host-modules/glue-matrix-bao-token.nix b/nix/host-modules/glue-matrix-bao-token.nix
index 3b40a403..4e84d8da 100644
--- a/nix/host-modules/glue-matrix-bao-token.nix
+++ b/nix/host-modules/glue-matrix-bao-token.nix
@@ -80,11 +80,12 @@ in
       # Sized for the race this loses, not for an unseal. `swarm-bao` comes up
       # seconds before this unit asks, and the cert-auth role it logs in
       # against is written seconds after — so a few short attempts cover it.
-      # ⚠️ `swarm-bao-controller-policy`'s 2880 × 30s is NOT the model to copy:
-      # that unit blocks nothing, while this one is `Before=` the homeserver's
-      # container, so every retry is time the homeserver may spend waiting. A
-      # store still sealed after this window keeps the degrade below, which is
-      # the same place it ends up today.
+      # ⚠️ `swarm-bao-controller-policy`'s 2880 × 30s is NOT the model to copy.
+      # That unit blocks nothing; this one is `Before=` the homeserver's
+      # container, and whether that ordering waits across an auto-restart is
+      # unverified — so an hours-long window would be a bet on an unknown,
+      # where a minute is not. A store still sealed after it keeps the degrade
+      # below, as today.
       #
       # `StartLimit*` are `[Unit]` settings, so they go here and not in
       # `serviceConfig` — systemd ignores them under `[Service]`. The window