diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index e1d788f0..6dc02848 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -68,7 +68,9 @@ in
   # registration token from the forge's admin API using the core token
   # hive-c0re writes to /var/lib/hyperhive/forge-core-token. No manual
   # token handling needed — `ci.enable = true` is the full operator
-  # bootstrap. See docs/ci.md for the registration flow.
+  # bootstrap. Registration flow: preStart calls the Forgejo admin API,
+  # writes the token to /run/hive-ci/runner-token, runner registers and
+  # persists credentials to stateDir — token file ignored on next boot.
   #
   # Nix builds inside the container use the shared /nix/store (standard
   # nixos-container behaviour) with sandbox-fallback = true, because