diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 0a8ef205..2376bc35 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -796,6 +796,8 @@ in
         #   /run/systemd           — container@ unit drop-ins (resource limits)
         #                            + machinectl / systemd-machined state
         #   /var/lib/nixos-containers — container rootfs written by nixos-container
+        #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
+        #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
         #   /nix                   — nix store + profile updates during
         #                            container create/update
         ProtectSystem = "strict";
@@ -805,6 +807,7 @@ in
           "/run/hive-agent"
           "/run/systemd"
           "/var/lib/nixos-containers"
+          "/var/lib/hyperhive"
           "/nix"
         ];
         # Writable HOME for nix's caches (see environment.HOME above).