diff --git a/nixos/modules/services/cluster/rke2/default.nix b/nixos/modules/services/cluster/rke2/default.nix
index 1c7ef3af1c8a..6e0cfd9df3fe 100644
--- a/nixos/modules/services/cluster/rke2/default.nix
+++ b/nixos/modules/services/cluster/rke2/default.nix
@@ -228,7 +228,7 @@ in
       }
       {
         assertion = cfg.role == "agent" -> !(cfg.agentTokenFile != null || cfg.agentToken != "");
-        message = "agentToken or agentTokenFile should be set if role is 'agent'";
+        message = "agentToken or agentTokenFile should NOT be set if role is 'agent'";
       }
       {
         assertion = cfg.role == "agent" -> !(cfg.disable != [ ]);