diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 9b4fca63..6ca1a0cb 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -964,16 +964,22 @@ let
       # proxying to a path nothing creates. All four old paths are defined in
       # the fixture, so removing any single shim fails the eval rather than
       # only the one this assertion reads.
-      # All FOUR movers are asserted as rendered effects rather than as option
-      # values, so a rename that resolved but stopped reaching the module is
-      # caught per-option instead of only where one assertion happens to look.
+      # THREE movers (authBridgeUrl, forgeTokenFile, queue.clientSecretFile)
+      # are asserted as rendered effects rather than as option values, so a
+      # rename that resolved but stopped reaching the module is caught
+      # per-option instead of only where one assertion happens to look.
+      # socketPath is no longer one of them: it went readOnly and lost its
+      # shim in the same slice, so it has no pre-rename path left to prove
+      # reaches the unit — the SOCKET line below instead pins the one value
+      # it can ever hold, the default, so the env var vanishing or being
+      # misspelled still fails this arm.
       name = "a config written against the pre-rename swarm-controller paths still reaches the unit";
       ok =
         let
           u = controllerOldPath.systemd.services.swarm-controller;
           creds = u.serviceConfig.LoadCredential;
         in
-        u.environment.SWARM_CONTROLLER_SOCKET == "/run/test-ctrl/ctrl.sock"
+        u.environment.SWARM_CONTROLLER_SOCKET == "/run/swarm-controller/controller.sock"
         && u.environment.SWARM_CONTROLLER_AUTH_BRIDGE_URL == "http://127.0.0.1:19097"
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-queue.secret" c) creds
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-forge.token" c) creds;