diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index 290ba095..7fa38086 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -178,6 +178,12 @@ collector's authelia client: authelia refuses any other session or client
 there. It refuses every other path, the store's write and admin
 API included, with 403. The bare domain redirects to vmui.
 
+The collector scrapes the store's own metrics the same way, at
+`https://<swarm.victoriametrics.domain>/metrics`, so a collector on a host
+that doesn't run the store still gets them. On this name the gateway admits
+only the collector's client to `/metrics` and the push route; any other
+session gets `deny`.
+
 ### Logs (VictoriaLogs)
 
 Each hive ships its journals to one VictoriaLogs at `logs.<swarm-domain>`,