diff --git a/internal/agent/updater/compose.go b/internal/agent/updater/compose.go
index 74eddff..3d54470 100644
--- a/internal/agent/updater/compose.go
+++ b/internal/agent/updater/compose.go
@@ -91,10 +91,10 @@ func NewComposeExecutor(cli ComposeDocker, resolve *Resolver, selfID string, run
 	return &ComposeExecutor{cli: cli, resolve: resolve, selfID: selfID, run: run, build: NewBuildChecker(cli, selfID, runOut)}
 }
 
-// Execute pins job.Ref to its current digest (a ref that has one is used as is), writes it to the stack's
-// override file and recreates the service. Working directory and config
-// files come from the service's container labels on this machine, never from
-// the job. It returns the pinned ref.
+// Execute pins job.Ref to its current digest (a ref that has one is used as
+// is), writes it to the stack's override file and recreates the service.
+// Working directory and config files come from the service's container
+// labels on this machine, never from the job. It returns the pinned ref.
 func (e *ComposeExecutor) Execute(ctx context.Context, job protocol.JobStart, out io.Writer) (string, error) {
 	project, service := job.ComposeProject, job.ComposeService
 	cts, err := e.cli.ContainerList(ctx, container.ListOptions{
diff --git a/internal/agent/updater/swarm.go b/internal/agent/updater/swarm.go
index d644c2d..0c34d31 100644
--- a/internal/agent/updater/swarm.go
+++ b/internal/agent/updater/swarm.go
@@ -35,11 +35,11 @@ func NewSwarmExecutor(cli SwarmClient, resolve *Resolver, auth *RegistryAuth) *S
 }
 
 // Execute checks that the local daemon is a manager of the job's cluster,
-// pins job.Ref to its current digest (a ref that has one is used as is) and updates the service to it. The
-// update is addressed by the ID and version of the service that was
-// inspected, so it changes exactly that object. Success means the daemon
-// accepted the new spec, not that the tasks have converged. It returns the
-// pinned ref.
+// pins job.Ref to its current digest (a ref that has one is used as is) and
+// updates the service to it. The update is addressed by the ID and version of
+// the service that was inspected, so it changes exactly that object. Success
+// means the daemon accepted the new spec, not that the tasks have converged.
+// It returns the pinned ref.
 func (e *SwarmExecutor) Execute(ctx context.Context, job protocol.JobStart, out io.Writer) (string, error) {
 	info, err := e.cli.Info(ctx)
 	if err != nil {
diff --git a/internal/master/web/server_test.go b/internal/master/web/server_test.go
index 68645c1..8be45c6 100644
--- a/internal/master/web/server_test.go
+++ b/internal/master/web/server_test.go
@@ -201,9 +201,15 @@ func newTestServer(t *testing.T) (*httptest.Server, *fakeStore, *fakeHub, *event
 	return srv, store, hub, broker
 }
 
-// newTestEnv starts the UI on fake storage. pollInterval is what the service
-// page shows as the polling interval; it defaults to zero.
-func newTestEnv(t *testing.T, pollInterval ...time.Duration) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
+// newTestEnv starts the UI on fake storage, with polling off.
+func newTestEnv(t *testing.T) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
+	t.Helper()
+	return newTestEnvPolling(t, 0)
+}
+
+// newTestEnvPolling is newTestEnv with pollInterval as the polling interval
+// the service page shows.
+func newTestEnvPolling(t *testing.T, pollInterval time.Duration) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
 	t.Helper()
 	agentID := int64(2)
 	store := &fakeStore{
@@ -227,7 +233,7 @@ func newTestEnv(t *testing.T, pollInterval ...time.Duration) (*httptest.Server,
 	jobs := &fakeJobs{}
 	s, err := New(store, hub, jobs, broker, Config{
 		AgentURL: "wss://10.0.0.5:8090/agent", MasterKey: "sha256:abc", AgentImage: "gitea.shcizo.se/shcizo/package-updater:latest",
-		PollInterval: append(pollInterval, 0)[0],
+		PollInterval: pollInterval,
 	}, slog.New(slog.NewTextHandler(io.Discard, nil)))
 	require.NoError(t, err)
 	mux := http.NewServeMux()
diff --git a/internal/master/web/templates/service.html b/internal/master/web/templates/service.html
index 8709bb1..0e46159 100644
--- a/internal/master/web/templates/service.html
+++ b/internal/master/web/templates/service.html
@@ -42,6 +42,7 @@
       <td><code title="{{.Ref}}">{{shortRef .Ref}}</code>{{if .Running}} <span class="badge">running</span>{{end}}{{if not .Tag}} <span class="muted">the service will follow no tag afterwards</span>{{end}}</td>
       <td>{{.Source}}</td>
       <td>{{.FirstSeenAt.Format "2006-01-02 15:04"}}</td>
+      {{/* AutoBlocked is the same check that decides whether the service can be updated with an explicit ref, which is what a pick is. */}}
       <td>{{if not $.AutoBlocked}}
         <form method="post" action="/services/{{$.Service.ID}}/update">
           <input type="hidden" name="csrf_token" value="{{$.CSRF}}">
diff --git a/internal/master/web/versions_test.go b/internal/master/web/versions_test.go
index 838ce5c..3946aed 100644
--- a/internal/master/web/versions_test.go
+++ b/internal/master/web/versions_test.go
@@ -111,7 +111,7 @@ func TestServicePage_PollingRow(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			srv, store, _, _, _ := newTestEnv(t, 6*time.Hour)
+			srv, store, _, _, _ := newTestEnvPolling(t, 6*time.Hour)
 			tt.edit(&store.services[0])
 
 			_, body := get(t, srv, "/services/1")