diff --git a/nixos/tests/grsecurity.nix b/nixos/tests/grsecurity.nix
index ed0101621520..e585a7402d34 100644
--- a/nixos/tests/grsecurity.nix
+++ b/nixos/tests/grsecurity.nix
@@ -32,6 +32,8 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->succeed("${pkgs.paxtest}/lib/paxtest/mprotstack") =~ /Killed/ or die;
     };
 
+    # tcc -run executes run-time generated code and so allows us to test whether
+    # paxmark actually works (otherwise, the process should be terminated)
     subtest "tcc", sub {
       $machine->execute("echo -e '#include <stdio.h>\nint main(void) { puts(\"hello\"); return 0; }' >main.c");
       $machine->succeed("${pkgs.tinycc.bin}/bin/tcc -run main.c");