diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index fab36d62..4d56bde9 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -581,7 +581,7 @@ in
           # `proxy_read_timeout 1h` (multi-GB clones). SSH stays direct on
           # `forge.sshPort`. See `docs/gateway.md`. Empty attrset when the
           # forge isn't behind the gateway.
-          forgeVhost = lib.optionalAttrs (forgeCfg.enable or false && forgeCfg.behindGateway or false) {
+          forgeVhost = lib.optionalAttrs (forgeCfg.behindGateway or false) {
             "${forgeCfg.domain}" = vhostTls // {
               listen = vhostListen;
               extraConfig = securityHeaders;
@@ -993,7 +993,7 @@ in
                 "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
               ]
               ++ lib.optional (
-                (forgeCfg.enable or false) && (forgeCfg.behindGateway or false)
+                (forgeCfg.behindGateway or false)
               ) "/${forgeCfg.domain}/${networkCfg.bridgeIp}"
               ++ lib.optional (
                 matrixCfg.enable && matrixCfg.gatewayHost != null