diff --git a/src/_zkapauthorizer/_plugin.py b/src/_zkapauthorizer/_plugin.py
index fbc01e94679391a6135be649a5acb0a7e8333ea2..c0c157c6a0deb1ed8d4c7b2ff3ddc81d0285eb63 100644
--- a/src/_zkapauthorizer/_plugin.py
+++ b/src/_zkapauthorizer/_plugin.py
@@ -174,7 +174,12 @@ class ZKAPAuthorizer(object):
         from twisted.internet import reactor
         redeemer = self._get_redeemer(node_config, announcement, reactor)
         store = self._get_store(node_config)
-        # XXX Need to ensure one of these per store
+
+        # Unlike our handling of the store, we make no effort to ensure there
+        # is only ever one SpendingController per database.
+        # SpendingController has no instance state so we can perfectly safely
+        # use several of them, pointing at the same underlying data set,
+        # concurrently without causing problems.
         controller = SpendingController.for_store(
             tokens_to_passes=redeemer.tokens_to_passes,
             store=store,