diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index a17d1242..90c2ca67 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -464,17 +464,28 @@ in
         ]
         ++ lib.optional (cfg.forgeTokenFile != null) "forge-token:${cfg.forgeTokenFile}";
 
-        # The empty default that makes the above non-fatal. `LoadCredential=`
-        # takes priority over `SetCredential=`, so this is only ever seen
-        # when the file is missing — and in that case systemd starts the unit
-        # instead of refusing to. The controller then serves its HTTP surface
-        # with the queue unconfigured, which is a supported shape it already
-        # knows how to report.
+        # The placeholder default that makes the above non-fatal.
+        # `LoadCredential=` takes priority over `SetCredential=`, so this is
+        # only ever seen when the file is missing — and in that case systemd
+        # starts the unit instead of refusing to. The controller then serves
+        # its HTTP surface with the queue unconfigured, which is a supported
+        # shape it already knows how to report.
         #
-        # Safe to put in a unit file precisely because it carries nothing:
+        # ⚠️ THE VALUE MUST BE NON-EMPTY. `SetCredential=<id>:` with an empty
+        # value is rejected by systemd's parser — *"Invalid syntax, ignoring"*
+        # — so the whole line is dropped and the fail-soft above silently does
+        # not exist. Measured with `systemd-analyze verify`: empty is refused,
+        # any non-empty value is accepted. This shipped broken and only looked
+        # fine because the credential file happened to be present.
+        #
+        # The word is deliberate rather than arbitrary: it reaches the token
+        # request as the client secret, so authelia refuses it and the journal
+        # says so in terms an operator can act on.
+        #
+        # Safe in a unit file precisely because it is not a secret:
         # `SetCredential=` values are readable by unprivileged processes over
-        # IPC, so a real secret must never appear here.
-        SetCredential = [ "queue-client.secret:" ];
+        # IPC, so real key material must never appear here.
+        SetCredential = [ "queue-client.secret:placeholder-no-secret-file" ];
         User = "swarm-controller";
         Group = "swarm-controller";
         Restart = "on-failure";