diff --git a/config/dot/quickshell/services/Polkit.qml b/config/dot/quickshell/services/Polkit.qml
index f0355e0..83dc901 100644
--- a/config/dot/quickshell/services/Polkit.qml
+++ b/config/dot/quickshell/services/Polkit.qml
@@ -43,6 +43,7 @@ Singleton {
     // Held only between pressing Enter and the helper accepting it on stdin.
     property string pendingSecret: ""
 
+
     function begin(path: string): void {
         // A second request while one is open would leave the first
         // unanswerable; polkit serializes these in practice, and refusing is
@@ -84,6 +85,8 @@ Singleton {
         helper.running = true;
     }
 
+    // Cancelled by the person at the keyboard, or withdrawn by whatever asked.
+    // Both close the prompt; only the first is something they did.
     function cancel(): void {
         root.dismiss("cancelled");
     }
diff --git a/config/local/share/systemd/user/panama-polkit-agent.service b/config/local/share/systemd/user/panama-polkit-agent.service
index 0c64f0f..734fed5 100644
--- a/config/local/share/systemd/user/panama-polkit-agent.service
+++ b/config/local/share/systemd/user/panama-polkit-agent.service
@@ -1,5 +1,10 @@
 [Unit]
 Description=Panama polkit authentication agent
+# Rate limiting lives in [Unit]. These were in [Service], where systemd ignored
+# them with a warning on every start -- so the restart limit they were meant to
+# impose was not actually in force.
+StartLimitBurst=5
+StartLimitIntervalSec=60
 Documentation=https://github.com/gibbyb/Panama
 # Only one agent may be registered per session, so this must not run alongside
 # the one it replaces.
@@ -14,10 +19,5 @@ ExecStart=%h/.config/quickshell/scripts/panama-polkit-agent
 # would be registered with nowhere to prompt. Restarting reconnects it.
 Restart=on-failure
 RestartSec=2
-# If this fails repeatedly, stop rather than flap: a session with no agent is
-# recoverable from a terminal, a session with a broken one is confusing.
-StartLimitBurst=5
-StartLimitIntervalSec=60
-
 [Install]
 WantedBy=graphical-session.target