diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix
index 5d599384..40bee15a 100644
--- a/nix/host-modules/hive-tls.nix
+++ b/nix/host-modules/hive-tls.nix
@@ -389,8 +389,9 @@ in
         A **separate** credential from
         {option}`services.hyperhive.deploy.bao.clientCertFile`, which is this
         hive's own reader identity and whose policy reads every secret the
-        hive is entitled to. A unit that renews one server certificate has no
-        business holding that.
+        hive is entitled to. `swarm-services-cert` never logs in with that one:
+        on a hive fronting no swarm name it presents it only for the mTLS
+        handshake of the root fetch, since `pki/ca/pem` takes no token.
 
         On a hive that mints its own store PKI a glue module supplies the leaf
         as a `mkDefault`; everywhere else it is the credential an operator
@@ -806,6 +807,8 @@ in
               err="$(mktemp)"
               raw="$(mktemp "$d/swarm-services-root.XXXXXX")"
               trap 'rm -f "$err" "$raw"' EXIT
+              # Interim: the reader cert is the handshake identity until each hive
+              # has its own narrow store identity for issuing its leaf.
               if ! curl --fail --silent --show-error \
                   ${storeRootCurlTls} --output "$raw" \
                   "$BAO_ADDR/v1/${baoServicesPkiMount}/ca/pem" 2>"$err"; then