diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index ca1a72e9..d40da6d2 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -144,7 +144,19 @@ let
       printf -- "        client_secret: '%s'\n" "$(cat ${lib.escapeShellArg "${clientsDir}/${c.id}.digest"})"
       printf -- '        authorization_policy: one_factor\n'
     ''
-    + lib.optionalString (c.tokenEndpointAuthMethod != null) ''
+    # ⚠️ `or null`, and it is not defensive noise: `allClients` is NOT
+    # uniformly submodule-typed. `cfg.oidc.clients` entries come through
+    # the submodule and carry every option's default; `hiveClients` is a
+    # raw attrset built in this file's `let` block and carries only the
+    # four fields written there. So a field added to the submodule exists
+    # on one half of this list and not the other, and reading it plainly
+    # is an eval error the moment `hiveIdentities` is on.
+    #
+    # That is exactly how this broke: `tokenEndpointAuthMethod` was added
+    # to the submodule and read here, which is fine for a declared client
+    # and fatal for a derived one. Anything read here needs `or` unless
+    # every producer is known to set it.
+    + lib.optionalString ((c.tokenEndpointAuthMethod or null) != null) ''
       printf -- '        token_endpoint_auth_method: %s\n' ${lib.escapeShellArg c.tokenEndpointAuthMethod}
     ''
     + (