diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md
index 743047cb..1421b0f5 100644
--- a/docs/swarm/credentials.md
+++ b/docs/swarm/credentials.md
@@ -568,6 +568,13 @@ leaves only while the store holds none, so a saved value survives their next run
 and every deploy. The cache's signing key, `attic/jwt-secret`, isn't writable here.
 Anything more needs a token.
 
+To replace one of the cache's leaves in the UI, open `secret` > `swarm` >
+`services` > `attic`, pick the leaf and choose **Create new version**. The
+form starts empty because the login can't read the current value: type the
+key `value` and the new value, and save. A new version replaces the whole
+secret, so `value` is the only key to enter. `bao kv put` with the same login
+works too.
+
 | piece                                                                               | written by                                                                                       |
 | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | authelia client, with redirect `swarm.bao.ui.oidc.redirectUri`                      | `glue-bao-ui-oidc-client.nix`, wherever authelia runs                                            |