diff --git a/docs/swarm/builder.md b/docs/swarm/builder.md
index 89d816fb..1f37ba11 100644
--- a/docs/swarm/builder.md
+++ b/docs/swarm/builder.md
@@ -59,11 +59,11 @@ Where it runs and how it's enabled: [`services.md`](services.md#builder).
 
 ## Credentials
 
-| What                    | Where                                             | Who reads it                             |
-| ----------------------- | ------------------------------------------------- | ---------------------------------------- |
-| store leaf              | `deploy.bao.builderClient{Cert,Key}File`          | nspawn, into the service as a credential |
-| queue client secret     | `secret/swarm/services/swarm-builder/oidc/client` | the builder, at start                    |
-| forge token (read-only) | `secret/swarm/services/builder/forge/token`       | the builder, on every build              |
+| What                    | Where                                             | Who reads it                                       |
+| ----------------------- | ------------------------------------------------- | -------------------------------------------------- |
+| store leaf              | `deploy.bao.builderClient{Cert,Key}File`          | nspawn, into the service as a credential           |
+| queue client secret     | `secret/swarm/services/swarm-builder/oidc/client` | the builder, at start and when authelia refuses it |
+| forge token (read-only) | `secret/swarm/services/builder/forge/token`       | the builder, on every build                        |
 
 The token belongs to the `builder` forge account, which swarm-controller
 creates, puts in the `hives` team of `agent-configs` (read on every config
diff --git a/swarm-builder/README.md b/swarm-builder/README.md
index 17a60fe3..78e9cc38 100644
--- a/swarm-builder/README.md
+++ b/swarm-builder/README.md
@@ -25,7 +25,8 @@ the answer into a `swarm-builder` commit status on the PR's head.
 
 The container holds one credential: its own store certificate, which nspawn
 hands in at start without a copy on disk. With it the service reads its
-queue client secret at start and its read-only forge token at every build.
+queue client secret at start and again when authelia refuses it, and its
+read-only forge token at every build.
 `git` gets the token through a credential helper reading the child's
 environment, never in a URL or an argument, and the helper answers only an
 `https` request for the forge's host. Its store role reads exactly