diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 2c799b5d..73c0b756 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -16,7 +16,6 @@ let
   # authorizes.
   calloutAccount = "AUTH";
   clientAccount = "APP";
-  calloutUser = "auth";
 in
 {
   # The swarm's message queue: one NATS server, reached by every hive.
@@ -227,12 +226,22 @@ in
                 # container on the shared netns — the same class of hole
                 # this module exists to close, moved rather than fixed.
                 # Caught in review on the first version of this file.
-                ${calloutAccount}.users = [
-                  {
-                    user = calloutUser;
-                    nkey = cfg.calloutUserPublicKey;
-                  }
-                ];
+                # An nkey and NOTHING else, both halves measured against a
+                # running server rather than reasoned about:
+                #
+                #   { user = "auth"; }               → `CONNECT {"user":"auth"}`
+                #                                      is accepted with no
+                #                                      credential at all
+                #   { user = "auth"; nkey = "U…"; }  → refuses to START:
+                #                                      "Nkey users do not take
+                #                                      usernames or passwords"
+                #   { nkey = "U…"; }                 → what this is
+                #
+                # A malformed key is fail-closed too: the server exits with
+                # "Not a valid public nkey for a user" rather than starting
+                # with a hole. So the only way to get a live server here is
+                # a real key whose seed nobody but the responder holds.
+                ${calloutAccount}.users = [ { nkey = cfg.calloutUserPublicKey; } ];
                 ${clientAccount} = { };
               };
 
@@ -260,7 +269,7 @@ in
                 # to say yes.
                 auth_callout = {
                   issuer = cfg.calloutIssuerPublicKey;
-                  auth_users = [ calloutUser ];
+                  auth_users = [ cfg.calloutUserPublicKey ];
                   account = calloutAccount;
                 };
               };