diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index d99061ff..b8ac71bb 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1269,8 +1269,17 @@ in
         # `hyperhive.user.passwordlessSudo = true` is configured
         # (#672 fixup pulled forward into this PR to avoid the
         # regression argus flagged on #676).
+        #
+        # `systemd.services.<name>.path` appends `/bin` to each entry,
+        # so the bare prefixes here resolve to `/run/wrappers/bin` +
+        # `/run/current-system/sw/bin` inside the unit's PATH. Passing
+        # the trailing `/bin` ourselves (the natural-looking spelling)
+        # would yield `/run/wrappers/bin/bin` + `/run/current-system/sw/bin/bin`,
+        # neither of which exists — that's how #672 originally landed
+        # broken: every agent had a PATH pointing at non-existent dirs
+        # and `which sudo` kept falling back to the un-setuid binary.
         path = [
-          "/run/wrappers/bin"
+          "/run/wrappers"
           "/run/current-system/sw"
         ];
         environment = {