diff --git a/services/crowdsec.nix b/services/crowdsec.nix
index 7a6ded1..9a2349e 100644
--- a/services/crowdsec.nix
+++ b/services/crowdsec.nix
@@ -82,7 +82,10 @@ in
         config.api.server.listen_uri = "127.0.0.1:8081";  # 8080 is qBit
         # CAPI: community blocklist + console (app.crowdsec.net). Setup auto-registers.
         config.api.server.online_client.credentials_path = "/var/lib/crowdsec/data/online_api_credentials.yaml";
-        console.enrollKeyFile = "/var/secrets/crowdsec-enroll-key";
+        # Already enrolled. No console.enrollKeyFile: setup re-ran `cscli
+        # console enroll` on every switch, and a CAPI outage (401) failed the
+        # 2026-10-08 nightly deploy and its rollback. Fresh install: run
+        # `sudo cscli console enroll "$(sudo cat /var/secrets/crowdsec-enroll-key)"` once.
 
         # Drop alerts originating from LAN clients before they're scored.
         # Without this, repeated Authelia 401s from inside the house (e.g.