diff --git a/docs/swarm/builder.md b/docs/swarm/builder.md
index 10385504..f9e8af86 100644
--- a/docs/swarm/builder.md
+++ b/docs/swarm/builder.md
@@ -294,6 +294,30 @@ Mixed versions:
 
 A record written before the field existed also reads as `false`.
 
+### External cache
+
+The cache can be an attic tenant on an instance outside the swarm. To point
+the swarm at an existing tenant:
+
+1. On the builder host, set `services.hyperhive.swarm.attic.domain` to the
+   instance's host name (no scheme, `host:port` if it isn't on 443) and
+   `services.hyperhive.swarm.attic.cache` to the cache's name on it.
+2. Seed the push token in the swarm secret store at
+   `secret/swarm/services/attic/push-token`, field `value`. Use the store's UI,
+   or `bao kv put` with `value=-` and the token on stdin, so the token is in no
+   command line. The token needs push rights on that cache. Until it
+   exists, every push fails and builds stay green with `cached` false.
+
+The builder checks the instance's certificate against the system roots and
+pins nothing, so a Let's Encrypt certificate needs no setup. The builder
+reads the token again on every push, so a new token takes effect on the next
+build.
+
+A later change adds the swarm's own attic service: `deploy.attic.enable` will run atticd
+in the swarm and fill these two options itself. An operator who sets that option
+to false keeps the external cache by setting the two options by hand and
+seeding the token as above.
+
 ## Credentials
 
 | What                    | Where                                             | Who reads it                                       |
diff --git a/nix/module-eval/builder.nix b/nix/module-eval/builder.nix
index 97cddf4c..7f8a1fa0 100644
--- a/nix/module-eval/builder.nix
+++ b/nix/module-eval/builder.nix
@@ -145,12 +145,12 @@ let
       ok =
         env.SWARM_BUILDER_ATTIC_DOMAIN == "cache.example.org"
         && env.SWARM_BUILDER_ATTIC_CACHE == "grid"
-        && hasOnPath "attic-client" svc
+        && hasOnPath "attic" svc
         && svc.serviceConfig.RuntimeDirectory == "swarm-builder"
         && svc.serviceConfig.RuntimeDirectoryMode == "0700"
-        && !(lib.any (lib.hasInfix "TOKEN") (lib.attrNames env))
+        && !(lib.any (lib.hasSuffix "TOKEN") (lib.attrNames env))
         && hasOnPath "git" withoutCache
-        && !(hasOnPath "attic-client" withoutCache)
+        && !(hasOnPath "attic" withoutCache)
         && !(withoutCache.environment ? SWARM_BUILDER_ATTIC_DOMAIN)
         && !(withoutCache.environment ? SWARM_BUILDER_ATTIC_CACHE);
     }