diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 69f489c9..0c80c52c 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -546,10 +546,6 @@ let
         && !(lib.hasInfix "client-ca.pem" s);
     }
     {
-      # The arm that makes the one above mean something, and the property the
-      # host-side half depends on: no store here, so no bind mount and no unit.
-      # Without it a hive that merely names a token would drag the store's
-      # container config into its evaluation.
       # Reads the vhost's rendered `root`, not the option: the UI is served
       # straight out of a store path, so a shim that resolves but stops
       # reaching the module would leave nginx pointing at the default build.
@@ -587,6 +583,10 @@ let
           == pkgs.emptyDirectory;
     }
     {
+      # What makes the granting-unit cases mean something, and the property
+      # the host-side half depends on: no store here, so no bind mount and no
+      # unit. Without it a hive that merely names a token would drag the
+      # store's container config into its evaluation.
       name = "a bootstrap token on a host that runs no store grants nothing";
       ok = !(baoGrantNoStore.systemd.services ? swarm-bao-bootstrap-dir);
     }