diff --git a/nix/host-modules/glue-matrix-bao-token.nix b/nix/host-modules/glue-matrix-bao-token.nix
index a89db5b3..fbc703b4 100644
--- a/nix/host-modules/glue-matrix-bao-token.nix
+++ b/nix/host-modules/glue-matrix-bao-token.nix
@@ -70,6 +70,10 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # What actually bounds the read below. Stated here rather than
+        # left to systemd's default, so the number a boot waits on is in
+        # the file that waits.
+        TimeoutStartSec = 30;
       };
       environment = {
         BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
@@ -80,9 +84,11 @@ in
       script = ''
         set -euo pipefail
 
-        # A sealed or uninitialised store answers on the port and times out on
-        # every read, so "the store is up" is not the same as "the store can
-        # answer" -- bound the wait rather than hanging the boot behind it.
+        # A sealed or uninitialised store answers on the port and never
+        # answers the read, so "the store is up" is not the same as "the
+        # store can answer". `TimeoutStartSec` above is the bound; the
+        # homeserver only `Wants=` this unit, so hitting it degrades to
+        # keeping the local token rather than holding up the container.
         if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
           echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
           echo "Keeping the token hive-matrix already has." >&2