diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index a631ac3f..39c635a5 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -77,8 +77,13 @@ The **swarm's** collector does need one. It runs in a container, so
 homeserver rows below, and for the same reason: the container that mints the
 secret isn't the container that reads it.
 
-The copy is only made when authelia is enabled **on this host** and something
-published is being scraped; otherwise no secret is needed and none is placed.
+The copy is made whenever authelia is enabled **on this host**, whatever this
+collector scrapes. The client it delivers for is registered unconditionally:
+authelia refuses a bearer-authz client with no audience, and the push audiences
+supply one even for a collector with nothing published to scrape. Like the
+hive-level delivery units below, this one waits a bounded 120s for authelia's
+mint and then fails rather than skipping, so a secret that never arrives takes
+the collector's container start with it instead of surfacing later as a 401.
 
 ⚠️ **Don't read that delivery unit as the only way this collector is fed.**
 Whether it authenticates follows the _credential_, never another service's