diff --git a/modules/workstation-setup.nix b/modules/workstation-setup.nix
index 9688eec..9bba724 100644
--- a/modules/workstation-setup.nix
+++ b/modules/workstation-setup.nix
@@ -231,11 +231,19 @@ let
 
           case "$line" in
             *"Initializing FIDO2 credential on security token"*)
+              # The first make-credential call follows this phase and requires
+              # physical presence when user-presence is enabled. systemd only
+              # emits a generic hint here, so notify the interface immediately.
               ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_INITIALIZING'
               ;;
             *"Generating secret key on FIDO2 security token"*)
+              # The assertion requiring the next touch follows immediately.
               ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_GENERATING'
               ;;
+            *"In order to allow secret key generation, please confirm presence on security token"*)
+              # Already announced by EVENT_FIDO_GENERATING: do not create a
+              # delayed duplicate touch request in the interface.
+              ;;
             *"Updating home directory"*)
               ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_UPDATING_HOME'
               ;;
@@ -243,6 +251,8 @@ let
               ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_SYNCHRONIZING'
               ;;
             *"confirm presence on security token"*)
+              # Later unlock/synchronization operations announce presence
+              # immediately before they wait for the physical touch.
               ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_TOUCH_REQUIRED'
               ;;
           esac
@@ -281,7 +291,7 @@ let
 
   workstationSetup = pkgs.stdenv.mkDerivation {
     pname = "nixos-workstations-setup";
-    version = "1.8.5";
+    version = "1.8.6";
 
     src = ../workstation-setup;