diff --git a/services/forgejo-runner.nix b/services/forgejo-runner.nix
index 68eabb8..f36d832 100644
--- a/services/forgejo-runner.nix
+++ b/services/forgejo-runner.nix
@@ -7,9 +7,10 @@
 #
 # The runner registration token is one-time-use: it must exist at the path
 # below on first activation, after which the runner stores its own auth in
-# /var/lib/gitea-runner. To register:
+# /var/lib/gitea-runner. The module loads this file as a systemd
+# EnvironmentFile, so it must use KEY=value format (not the raw token):
 #
-#   echo 'YOUR_REGISTRATION_TOKEN' | sudo tee /var/secrets/forgejo-runner-token
+#   echo 'TOKEN=YOUR_REGISTRATION_TOKEN' | sudo tee /var/secrets/forgejo-runner-token
 #   sudo chmod 600 /var/secrets/forgejo-runner-token
 { config, lib, pkgs, ... }:
 {