diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index 1645f3c7..ebc9f7fd 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -10,9 +10,9 @@
 #   deploy.*  — this machine's deployment decisions. Necessarily different
 #               on every host, because that is what a deployment is.
 #
-# The `enable` toggles used to live under `swarm.*`, which made the
-# namespace that is supposed to be identical everywhere carry the one
-# thing that must differ.
+# The `enable` toggles live here rather than under `swarm.*` so the
+# namespace that is identical everywhere does not carry the one thing
+# that must differ per host.
 #
 # Flat and named for the thing deployed — `deploy.forgejo`, not
 # `deploy.swarmServices.forgejo`: grouping by "swarm service" re-encodes
@@ -161,6 +161,32 @@ in
       '';
     };
 
+    bao.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Run the swarm's secret store in a `swarm-bao` container on this
+        host. A swarm has one store and it has to exist somewhere, so
+        this is asserted from
+        {option}`services.hyperhive.swarm.enableRequiredServices`
+        alongside the other once-per-swarm services.
+
+        That assertion is a `mkDefault`, which is what keeps *where* the
+        store runs a separate question from *that* it runs: set this
+        directly to put the store on a host of its own, and clients
+        still reach it by name at
+        {option}`services.hyperhive.swarm.bao.domain` rather than at a
+        local address.
+
+        With it off, this hive is a *client*: it still reads its own
+        secrets from whoever runs the store, authenticating with its own
+        client certificate. Every hive needs the client half; only one
+        runs the server half, which is why the two live in different
+        namespaces.
+      '';
+    };
+
     authelia.enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -223,8 +249,9 @@ in
       default = false;
       description = ''
         Run the swarm's message queue in a `swarm-nats` container on this
-        host. A swarm has one queue, so this belongs on the same host as
-        the rest of the shared services.
+        host. A swarm has one queue, so at most one host turns this on —
+        but *which* host is its own decision, not necessarily the one
+        running the swarm's other shared services.
 
         Off by default, and off means *absent*: no container is created
         and nothing else in the evaluated config changes.
diff --git a/nix/host-modules/swarm-required-services.nix b/nix/host-modules/swarm-required-services.nix
index c69eeaff..a3c649f5 100644
--- a/nix/host-modules/swarm-required-services.nix
+++ b/nix/host-modules/swarm-required-services.nix
@@ -90,4 +90,11 @@ in
   # hive that is not the service host is a *client* of it, not a second one.
   config.services.hyperhive.deploy.victorialogs.enable =
     lib.mkDefault swarmCfg.enableRequiredServices;
+
+  # The secret store. Once per swarm and optional, so it belongs to the
+  # same switch: a hive that does not run it is a *client*, reading its
+  # own secrets from whoever does. `mkDefault` is what keeps the store
+  # placeable on a host of its own — it can be set directly here and
+  # turned off wherever this switch happens to be on.
+  config.services.hyperhive.deploy.bao.enable = lib.mkDefault swarmCfg.enableRequiredServices;
 }