diff --git a/nix/host-modules/nats-callout-removed.nix b/nix/host-modules/nats-callout-removed.nix
index 24a6d426..0efb5f6a 100644
--- a/nix/host-modules/nats-callout-removed.nix
+++ b/nix/host-modules/nats-callout-removed.nix
@@ -1,5 +1,6 @@
 # Removal shim for the queue's callout nkey options, and for the copies of
-# their seeds inside the `swarm-nats` container.
+# their seeds and of the responder's OIDC client secret inside the
+# `swarm-nats` container.
 #
 # The callout issuer and user keys live in the swarm secret store beside the
 # callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
@@ -33,7 +34,7 @@ let
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
   ];
 
-  containerSeedDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
+  containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
 in
 {
   imports = lib.concatLists [
@@ -44,9 +45,11 @@ in
     (removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
   ];
 
-  # The responder reads both seeds from the store and names neither file.
-  systemd.tmpfiles.rules = map (f: "r ${containerSeedDir}/${f}") [
+  # The responder reads both seeds and its OIDC client secret from the store
+  # and names none of these files.
+  systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
     "callout-user.seed"
     "issuer.seed"
+    "oidc-client.secret"
   ];
 }
diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 8fa80cd7..0c56e96b 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -513,13 +513,7 @@ in
     # The bind source has to exist before the container starts, leaf or not:
     # nixos-container refuses to start over a missing one, which would take
     # the whole queue down rather than only its TLS.
-    #
-    # The `r` removes a copy of the responder's OIDC client secret a container
-    # may still hold: the responder reads it from the store and names no file.
-    systemd.tmpfiles.rules = [
-      "d ${tlsDir} 0755 root root -"
-      "r ${hostPath "oidc-client.secret"}"
-    ];
+    systemd.tmpfiles.rules = [ "d ${tlsDir} 0755 root root -" ];
 
     containers.swarm-nats = {
       autoStart = true;
diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix
index 69cb2a37..1d009b75 100644
--- a/nix/module-eval/nats-authelia.nix
+++ b/nix/module-eval/nats-authelia.nix
@@ -406,9 +406,10 @@ let
     {
       # The responder reads its OIDC secret from the store itself, so no host
       # unit fetches it, no credential or flag carries it, and a copy a
-      # container still holds is removed. On or off the store's host alike;
-      # the callout key fetch beside it is the control that the unit set is
-      # read at all, and the store cert role the control on the flags.
+      # container still holds is removed, also on a host with the queue off.
+      # On or off the store's host alike; the callout key fetch beside it is
+      # the control that the unit set is read at all, and the store cert role
+      # the control on the flags.
       name = "the responder's OIDC secret is fetched by no unit and carried by no credential or flag, and the container's copy is removed";
       ok =
         let
@@ -418,14 +419,16 @@ let
             && h.systemd.services ? swarm-bao-nats-callout-xkey;
           u = responderOf natsWithStoreIdentity;
           copy = natsWithStoreIdentity.systemd.services.swarm-nats-auth-secrets.script;
-          rules = natsWithStoreIdentity.systemd.tmpfiles.rules;
+          removesCopy = h: lib.elem "r ${dir}/oidc-client.secret" h.systemd.tmpfiles.rules;
+          dir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
         in
         fetchedNowhere natsWithStoreIdentity
         && fetchedNowhere natsOnStoreHost
         && !(lib.any (lib.hasInfix "oidc-client") u.serviceConfig.LoadCredential)
         && !(lib.hasInfix "client-secret" u.serviceConfig.ExecStart)
         && lib.hasInfix "--store-cert-role swarm-nats-auth" u.serviceConfig.ExecStart
-        && lib.elem "r /var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth/oidc-client.secret" rules
+        && removesCopy natsWithStoreIdentity
+        && removesCopy autheliaNotColocated
         && !(lib.hasInfix "oidc-client" copy)
         && !(lib.hasInfix "authelia" copy);
     }