diff --git a/docs/swarm/ui.md b/docs/swarm/ui.md
index 99017caf..b2c773b0 100644
--- a/docs/swarm/ui.md
+++ b/docs/swarm/ui.md
@@ -114,6 +114,7 @@ same whichever host runs each service:
 | Metrics  | `services.hyperhive.swarm.victoriametrics.domain` |
 | Logs     | `services.hyperhive.swarm.victorialogs.domain`    |
 | Matrix   | `services.hyperhive.swarm.matrix.gatewayHost`     |
+| Bao      | `services.hyperhive.swarm.bao.ui.domain`          |
 
 `nix/host-modules/swarm-controller.nix` builds these entries. The Forge
 entry, and `swarm-ui.nix`'s entry for this UI's own API docs, come from
@@ -127,6 +128,9 @@ gateway host, `chat.<swarm domain>` by default. The homeserver's host
 always serves the client at `/` on that vhost, so the entry is present
 whenever the swarm names a gateway host.
 
+The **Bao** entry opens the secret store's web UI, which admits members of
+authelia's `admins` group only; see [`secrets.md`](secrets.md#the-browser-ui).
+
 <details><summary>Adding a swarm service name: the two wiring sites</summary>
 
 Adding a swarm service name means touching two things. Missing the
diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 5167a65b..7ec89a69 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -51,6 +51,11 @@ let
           icon = "📜";
           inherit (swarmCfg.victorialogs) domain;
         }
+        {
+          label = "Bao";
+          icon = "🔐";
+          inherit (swarmCfg.bao.ui) domain;
+        }
       ]
     # A null `gatewayHost` means no vhost fronts the homeserver, so there is
     # no web client to link to.
@@ -458,7 +463,8 @@ in
         or swarm-ui change.
 
         The Authelia, Grafana, Metrics and Logs entries come from
-        `services.hyperhive.swarm.<service>.domain`, and the Matrix entry
+        `services.hyperhive.swarm.<service>.domain`, the Bao entry from
+        `services.hyperhive.swarm.bao.ui.domain`, and the Matrix entry
         from `services.hyperhive.swarm.matrix.gatewayHost` when it is set,
         so they are present whichever host runs each service.
         `hive-forge/default.nix` and `swarm-ui.nix` contribute their own
diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index 57567c64..1a5a7e7e 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -116,8 +116,8 @@ let
       Metrics = s.victoriametrics.domain;
       Logs = s.victorialogs.domain;
       Matrix = s.matrix.gatewayHost;
+      Bao = s.bao.ui.domain;
       # forge: added once hive-forge/default.nix drops its per-host link
-      # bao: its web UI at `swarm.bao.ui.domain` has no link yet
     };
   swarmServiceLinksOf =
     cfg: