diff --git a/services/crowdsec.nix b/services/crowdsec.nix
index d35905c..e66ba48 100644
--- a/services/crowdsec.nix
+++ b/services/crowdsec.nix
@@ -1,10 +1,11 @@
 # services/crowdsec.nix — Vendors the crowdsec module rewrite from
 # https://github.com/NixOS/nixpkgs/pull/446307 (TornaxO7's branch) until
-# it lands upstream. The upstream module in nixpkgs at the pinned revision
-# is broken for first-time bootstrap (no auto cscli machines add, DynamicUser
-# state ownership wedges).
+# it lands upstream. PR #446307 was closed 2026-06-26, superseded by
+# https://github.com/NixOS/nixpkgs/pull/535319 (still open). The upstream
+# module in nixpkgs at the pinned revision is broken for first-time
+# bootstrap (no auto cscli machines add, DynamicUser state ownership wedges).
 #
-# When PR #446307 merges to nixpkgs unstable:
+# When PR #535319 merges to nixpkgs unstable:
 #   1. Bump flake.lock past the merge commit
 #   2. Delete ../modules/crowdsec/ and the disabledModules + imports lines below
 #   3. The settings/option API is the same as the PR's, so config below is forward-compatible