diff --git a/src/skills/style/nix/rules/dotfiles.md b/src/skills/style/nix/rules/dotfiles.md
index b6262fa..da385fc 100644
--- a/src/skills/style/nix/rules/dotfiles.md
+++ b/src/skills/style/nix/rules/dotfiles.md
@@ -39,4 +39,5 @@ Each guest service group accesses its secrets through a read-only bind mount.
 
 ### Rationale
 
-SOPS decrypts the secret on the host before the guest receives its bind mount.
+SOPS applies secret ownership on the host before the guest starts.
+Read-only bind mounts give guest service groups access without write access.