diff --git a/docs/swarm/README.md b/docs/swarm/README.md
index eb61c462..be229c74 100644
--- a/docs/swarm/README.md
+++ b/docs/swarm/README.md
@@ -132,6 +132,14 @@ reader `deploy.bao.clientCertFile`: issue a leaf whose subject is
 do, `swarm-bao-nats-tls` fails naming both whenever the queue's certificate is
 missing or due for renewal.
 
+The queue host's gateway also serves the queue's metrics, at
+`https://<swarm.nats.domain>/metrics`, so a swarm collector on any host
+scrapes them. Only the collector's authelia client gets through; any other
+session gets `deny`, and every other path on that name is 403. With the
+gateway's default self-signed TLS, that vhost serves the queue's own
+certificate, so a host whose only swarm service is the queue needs no
+swarm-services certificate.
+
 The identity isn't a choice — a hive authenticates as `hive-<hiveName>`
 and publishes under `hiveName`, the same name that keys `swarm.hives`.