diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix
index 998286f7..3478c1b8 100644
--- a/nix/host-modules/swarm-ui.nix
+++ b/nix/host-modules/swarm-ui.nix
@@ -127,7 +127,7 @@ in
 
     # The swarm UI's own gateway surface. Published to agents on the
     # bridge deliberately: reachability is not the access control here —
-    # the `auth_request` below and authelia's `group:operators` rule
+    # the `auth_request` below and authelia's `group:admins` rule
     # are, and an agent that resolves the name still cannot open the
     # page.
     #
@@ -159,9 +159,9 @@ in
     #
     # ⚠️ `auth_request` answers "is there a session", not "is this an
     # operator". The operator-only part is authelia's `access_control`
-    # rule (./swarm-authelia.nix) requiring `group:operators` — agents
-    # have authelia accounts of their own, and without that rule a
-    # session alone would open this page.
+    # rules (`operatorsOnly` in ./swarm-authelia.nix): `group:admins`, then
+    # a `deny` for everyone else. Agents have authelia accounts of their
+    # own, and without those rules a session alone would open this page.
     #
     # ⚠️ Failure mode here is LOCKED OUT, not unprotected: a subrequest
     # that wrongly denies takes the whole UI away. That is why the