diff --git a/home/base/tui/shell/default.nix b/home/base/tui/shell/default.nix
index 1290c2de..5bb8c8b1 100644
--- a/home/base/tui/shell/default.nix
+++ b/home/base/tui/shell/default.nix
@@ -10,7 +10,7 @@
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      # decrypted secret: AI agents must not read the sourced file, only reference the path
+      # decrypted secret: AI agents must not read it
       source /etc/agenix/nushell-secrets.nu
 
       # Directories in this constant are searched by the
diff --git a/home/base/tui/ssh.nix b/home/base/tui/ssh.nix
index 10ae885a..3e243fcf 100644
--- a/home/base/tui/ssh.nix
+++ b/home/base/tui/ssh.nix
@@ -35,6 +35,7 @@
 
       "192.168.*" = {
         ForwardAgent = true;
+        # decrypted secret: AI agents must not read it
         IdentityFile = "/etc/agenix/ssh-key-romantic";
         IdentitiesOnly = true;
       };
diff --git a/modules/darwin/nix-core.nix b/modules/darwin/nix-core.nix
index bfffc43f..502e0d0c 100644
--- a/modules/darwin/nix-core.nix
+++ b/modules/darwin/nix-core.nix
@@ -27,6 +27,7 @@
   system.stateVersion = 5;
 
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }
diff --git a/modules/nixos/base/remote-building.nix b/modules/nixos/base/remote-building.nix
index 10720627..e3fa0e1e 100644
--- a/modules/nixos/base/remote-building.nix
+++ b/modules/nixos/base/remote-building.nix
@@ -17,7 +17,7 @@
   nix.buildMachines =
     let
       sshUser = myvars.username;
-      # ssh key's path on local machine
+      # ssh key's path on local machine; a decrypted secret AI agents must not read
       sshKey = "/etc/agenix/ssh-key-romantic";
       systems = [
         # native arch
diff --git a/modules/nixos/desktop/nix.nix b/modules/nixos/desktop/nix.nix
index 5a2310c6..36316818 100644
--- a/modules/nixos/desktop/nix.nix
+++ b/modules/nixos/desktop/nix.nix
@@ -1,6 +1,7 @@
 { config, ... }:
 {
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }