diff --git a/nix/modules/acme-dns.nix b/nix/modules/acme-dns.nix
index caa8b5e..c4f9d49 100644
--- a/nix/modules/acme-dns.nix
+++ b/nix/modules/acme-dns.nix
@@ -111,82 +111,89 @@ in
       "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
     ];
 
-    services.acme-dns = {
-      description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      serviceConfig = {
-        User = "acme-dns";
-        Group = "acme-dns";
-        StateDirectory = "acme-dns";
-        StateDirectoryMode = "0700";
-        WorkingDirectory = "/var/lib/acme-dns";
-        ExecStart = "${pkgs.acme-dns}/bin/acme-dns -c ${acmeDnsConfig}";
-        Restart = "on-failure";
-        RestartSec = "5s";
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-        NoNewPrivileges = true;
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-        ProtectSystem = "strict";
-        ReadWritePaths = [ "/var/lib/acme-dns" ];
-        RestrictAddressFamilies = [ "AF_INET" "AF_UNIX" ];
+    # Three systemd units (W201 statix): one attrset, distinct unit names — avoids
+    # `services = { ... }` attribute sets repeating the `services` key.
+    services = {
+      acme-dns = {
+        description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        serviceConfig = {
+          User = "acme-dns";
+          Group = "acme-dns";
+          StateDirectory = "acme-dns";
+          StateDirectoryMode = "0700";
+          WorkingDirectory = "/var/lib/acme-dns";
+          ExecStart = "${pkgs.acme-dns}/bin/acme-dns -c ${acmeDnsConfig}";
+          Restart = "on-failure";
+          RestartSec = "5s";
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectHome = true;
+          ProtectSystem = "strict";
+          ReadWritePaths = [ "/var/lib/acme-dns" ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_UNIX" ];
+        };
       };
-    };
 
-    # Seed the new cert's acmedns storage before the ACME unit first runs (see
-    # acmeStorageSeed above). Ordering via the generated acme unit name.
-    services.cc-ci-acme-storage-seed = {
-      description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
-      after = [ "acme-dns.service" ];
-      wantedBy = [ "acme-ci.autonomic.zone.service" ];
-      before = [ "acme-ci.autonomic.zone.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        UMask = "0077";
+      # Seed the new cert's acmedns storage before the ACME unit first runs (see
+      # acmeStorageSeed above). Ordering via the generated acme unit name.
+      cc-ci-acme-storage-seed = {
+        description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
+        after = [ "acme-dns.service" ];
+        wantedBy = [ "acme-ci.autonomic.zone.service" ];
+        before = [ "acme-ci.autonomic.zone.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          UMask = "0077";
+        };
+        script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
       };
-      script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
-    };
 
-    # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
-    # host certificate must be copied and reconciled rather than merely reloaded.
-    # This service is started only by the production-mode ACME postRun hook.
-    services.cc-ci-acme-traefik-handoff = {
-      description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
-      after = [ "docker.service" "deploy-proxy.service" ];
-      requires = [ "docker.service" ];
-      path = [ pkgs.coreutils pkgs.docker pkgs.systemd pkgs.gnugrep ];
-      serviceConfig = {
-        Type = "oneshot";
-        UMask = "0077";
+      # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
+      # host certificate must be copied and reconciled rather than merely reloaded.
+      # This service is started only by the production-mode ACME postRun hook.
+      # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
+      # host certificate must be copied and reconciled rather than merely reloaded.
+      # This service is started only by the production-mode ACME postRun hook.
+      cc-ci-acme-traefik-handoff = {
+        description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
+        after = [ "docker.service" "deploy-proxy.service" ];
+        requires = [ "docker.service" ];
+        path = [ pkgs.coreutils pkgs.docker pkgs.systemd pkgs.gnugrep ];
+        serviceConfig = {
+          Type = "oneshot";
+          UMask = "0077";
+        };
+        script = ''
+          src=/var/lib/acme/ci.autonomic.zone
+          dst=/var/lib/ci-certs/live
+          test -s "$src/fullchain.pem"
+          test -s "$src/key.pem"
+          install -d -m 0700 "$dst"
+          install -m 0444 "$src/fullchain.pem" "$dst/fullchain.pem.new"
+          install -m 0400 "$src/key.pem" "$dst/privkey.pem.new"
+          mv -f "$dst/fullchain.pem.new" "$dst/fullchain.pem"
+          mv -f "$dst/privkey.pem.new" "$dst/privkey.pem"
+
+          # deploy-proxy performs the health-gated Swarm rollout. Its reconciler
+          # derives a fresh version from the public certificate chain and inserts
+          # the matching ssl_cert/ssl_key secrets before deploying Traefik.
+          systemctl restart deploy-proxy.service
+
+          # A successful rollout no longer references old wildcard versions. Best
+          # effort removal retains any secret Docker still reports as in use.
+          keep="v$(sha256sum "$dst/fullchain.pem" | cut -c1-16)"
+          docker secret ls --format '{{.Name}}' | \
+            grep -E '^traefik_ci_commoninternet_net_ssl_(cert|key)_v' | \
+            grep -v -E "_(ssl_cert|ssl_key)_$keep\$" | \
+            while IFS= read -r stale; do docker secret rm "$stale" || true; done
+        '';
       };
-      script = ''
-        src=/var/lib/acme/ci.autonomic.zone
-        dst=/var/lib/ci-certs/live
-        test -s "$src/fullchain.pem"
-        test -s "$src/key.pem"
-        install -d -m 0700 "$dst"
-        install -m 0444 "$src/fullchain.pem" "$dst/fullchain.pem.new"
-        install -m 0400 "$src/key.pem" "$dst/privkey.pem.new"
-        mv -f "$dst/fullchain.pem.new" "$dst/fullchain.pem"
-        mv -f "$dst/privkey.pem.new" "$dst/privkey.pem"
-
-        # deploy-proxy performs the health-gated Swarm rollout. Its reconciler
-        # derives a fresh version from the public certificate chain and inserts
-        # the matching ssl_cert/ssl_key secrets before deploying Traefik.
-        systemctl restart deploy-proxy.service
-
-        # A successful rollout no longer references old wildcard versions. Best
-        # effort removal retains any secret Docker still reports as in use.
-        keep="v$(sha256sum "$dst/fullchain.pem" | cut -c1-16)"
-        docker secret ls --format '{{.Name}}' | \
-          grep -E '^traefik_ci_commoninternet_net_ssl_(cert|key)_v' | \
-          grep -v -E "_(ssl_cert|ssl_key)_$keep\$" | \
-          while IFS= read -r stale; do docker secret rm "$stale" || true; done
-      '';
     };
   };
 
diff --git a/runner/harness/warm.py b/runner/harness/warm.py
index 988afcc..f7f7a3f 100644
--- a/runner/harness/warm.py
+++ b/runner/harness/warm.py
@@ -41,7 +41,9 @@ _CTX.check_hostname = False
 _CTX.verify_mode = ssl.CERT_NONE
 
 # A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
-_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
+_STACK_HEX_RE = re.compile(
+    r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_"
+)
 
 
 def stable_domain(recipe: str) -> str: