diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index d5d45470..d18b825c 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -547,11 +547,10 @@ in
         writes — not a credential belonging to the controller. Nothing outside
         the store needs it except whatever issues that leaf.
 
-        ⚠️ The CA this role trusts also signs each hive's reader leaf, whose CN
-        is the hive's own name, so a hive named `swarm-controller` would satisfy
-        the role. Changing this to something outside the hive-name grammar
-        (`[a-z0-9-]`) rules that out — at the cost of a role rename in any store
-        that has already run the granting unit.
+        ⚠️ Reserved as a hive name. A hive's own leaf carries its name as the
+        CN, so a hive named after this subject would satisfy the role —
+        ./swarm.nix feeds this value into the guard on
+        {option}`services.hyperhive.swarm.hives` to make that unrepresentable.
       '';
     };
 
@@ -947,10 +946,9 @@ in
           esac
 
           # `certificate=` is the CA, so this role trusts every leaf that
-          # CA signed and `allowed_common_names` is the whole of what
-          # narrows it to one identity. ⚠️ The same CA signs each hive's
-          # reader leaf with CN = the hive's name, so a hive named
-          # `${controllerCn}` would satisfy this role.
+          # CA signed and `allowed_common_names` is the whole narrowing —
+          # which is why ./swarm.nix reserves this subject as a hive name,
+          # and why a role added beside this one must join that list.
           #
           # Named outside the `hive-*` namespace the policy grants, so the
           # controller cannot rewrite the role that constrains it.