diff --git a/hive-sh4re/src/assets.rs b/hive-sh4re/src/assets.rs
index 9802a2de..fe160f08 100644
--- a/hive-sh4re/src/assets.rs
+++ b/hive-sh4re/src/assets.rs
@@ -3,9 +3,11 @@
 //! (`hive-c0re`) and the in-container harness binaries so they agree
 //! on the lookup contract.
 //!
-//! At runtime, the path is read from `$HIVE_ASSETS_DIR`. In nix
-//! builds that env var is set by the `hive-c0re` / `harness-base` modules
-//! to `${pkgs.hyperhive-assets}/share/hyperhive` (see `nix/assets.nix`).
+//! At runtime, the path is read from `$HIVE_ASSETS_DIR`. In nix builds
+//! that env var is set to `${pkgs.hyperhive-assets}/share/hyperhive` by
+//! `nix/host-modules/hive-c0re/environment.nix` (host daemon) and
+//! `nix/agent-modules/default.nix` + `agent-service.nix` (containers);
+//! the package itself is built by `nix/packages/assets.nix`.
 //! For `cargo run` outside nix, set it yourself:
 //!
 //! ```sh
diff --git a/nix/agent-modules/weston-vnc.nix b/nix/agent-modules/weston-vnc.nix
index 2795976b..6599f92f 100644
--- a/nix/agent-modules/weston-vnc.nix
+++ b/nix/agent-modules/weston-vnc.nix
@@ -6,7 +6,7 @@
 }:
 let
   # GUI processes run as the agent's own non-root user — the same user
-  # hive-agent runs as (declared + home-chowned by harness-base.nix) — so
+  # hive-agent runs as (declared + home-chowned by ./user.nix) — so
   # weston, the wayland client, and the agent share one user session.
   # `hyperhive.user.name` is set per-agent by the meta-flake renderer.
   userName = config.hyperhive.user.name;
diff --git a/nix/host-modules/hive-ci.nix b/nix/host-modules/hive-ci.nix
index b33fb22d..d9a51204 100644
--- a/nix/host-modules/hive-ci.nix
+++ b/nix/host-modules/hive-ci.nix
@@ -280,7 +280,7 @@ in
           # sandboxing always fails. Fall back to unsandboxed builds.
           # Moot once every nix invocation in the container routes
           # through the host daemon (the daemon governs sandboxing).
-          # See docs/gotchas.md and harness-base.nix.
+          # See docs/gotchas.md and nix/agent-modules/default.nix.
           nix.settings.sandbox-fallback = lib.mkForce true;
           # Degrade to a local build when a remote builder is unreachable
           # rather than failing the check. `fallback` is a client-side
diff --git a/nix/packages/default.nix b/nix/packages/default.nix
index 00954079..4b3b6668 100644
--- a/nix/packages/default.nix
+++ b/nix/packages/default.nix
@@ -119,8 +119,8 @@ let
       '';
 
   # Per-bin split packages. Agent containers depend on the individual
-  # bins they actually exec/PATH-need (see harness-base.nix) instead
-  # of the `default` bundle — that keeps `hivectl` (dials the *host*
+  # bins they actually exec/PATH-need (see nix/agent-modules/packages.nix)
+  # instead of the `default` bundle — that keeps `hivectl` (dials the *host*
   # admin socket, unreachable from inside a container, drags in
   # `wireguard-tools`) and redundant binaries out of every agent's
   # closure.