diff --git a/modules/hosts/t480/usb-wakeup.nix b/modules/hosts/t480/usb-wakeup.nix
index 0adc31b..95f8a1a 100644
--- a/modules/hosts/t480/usb-wakeup.nix
+++ b/modules/hosts/t480/usb-wakeup.nix
@@ -7,11 +7,12 @@
       # cannot wake the machine after an unplug-triggered suspend. The built-in xHCI
       # (00:14.0) stays wake-capable in S3, so a keyboard on a built-in port works.
       #
-      # Arm the built-in xHCI root hubs (idVendor 1d6b = Linux Foundation root hub),
-      # scoped to the built-in controller so the TB3 root hubs are left untouched.
-      ACTION=="add", SUBSYSTEM=="usb", KERNELS=="0000:00:14.0", ATTR{idVendor}=="1d6b", ATTR{power/wakeup}="enabled"
-      # Arm the IQUNIX MQ80 keyboard itself. Match by VID:PID — the USB bus path
-      # is unstable across re-enumeration, so path-based matching is unreliable.
+      # Arm ONLY the keyboard itself (match by VID:PID — the USB bus path is
+      # unstable across re-enumeration). Deliberately do NOT arm the built-in root
+      # hubs: arming a whole root hub makes it wake on hub-level events (USB-C PD
+      # negotiation, the SD card reader, internal peripherals), causing spurious
+      # self-wakes. A leaf device's remote-wakeup propagates through the hub without
+      # the hub's own wakeup flag being set.
       ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="320f", ATTR{idProduct}=="5055", ATTR{power/wakeup}="enabled"
     '';
   };