diff --git a/docs/network.md b/docs/network.md
index 4fbc8dc9..40128d26 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -145,6 +145,17 @@ agent containers.
   container, shared host netns) for the forge sub-domain, per-agent
   UI proxies, and any other HTTP services.
 
+The **host** firewall is the only firewall. The shared-netns infra
+containers (gateway, forge, matrix) set
+`networking.firewall.enable = false`: a NixOS firewall inside a
+shared-netns container runs against the *host* ruleset — at container
+boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them
+from the container's (empty) port list, and deletes the host's
+`nixos-nat-*` chains without recreating them, silently wiping the
+bridge holes above plus the agents' NAT. Private-netns containers
+(agents, hive-ci) may keep their own firewall — it is scoped to their
+namespace.
+
 ### Reaching host services (`exposeHostPorts`)
 
 By default agents can only reach the host on 80/443 (+53 DNS), so a
diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 0bdab6f6..bdef1cc1 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -327,6 +327,14 @@ in
         in
         {
           system.stateVersion = "25.11";
+
+          # Shared host netns: this container's own firewall.service
+          # would rewrite the HOST ruleset (flush nixos-fw, drop the
+          # host's nixos-nat-* chains) at every boot — killing the
+          # bridge DHCP/DNS holes and agent NAT. The host firewall owns
+          # all filtering; never run one in here.
+          networking.firewall.enable = false;
+
           services.forgejo = {
             enable = true;
             package = cfg.package;
diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix
index 24555a1f..e8a6b55b 100644
--- a/nix/host-modules/hive-gateway/default.nix
+++ b/nix/host-modules/hive-gateway/default.nix
@@ -163,6 +163,15 @@ in
         {
           system.stateVersion = "26.05";
 
+          # This container shares the host netns, so its own
+          # firewall.service would run against the HOST ruleset: flush
+          # the nixos-fw chains, rebuild them from this container's
+          # (empty) port list, and delete the host's nixos-nat-* chains
+          # — wiping the bridge DHCP/DNS holes and the agents' NAT on
+          # every container boot. The host firewall owns all filtering;
+          # never run one in here.
+          networking.firewall.enable = false;
+
           # Keep the host-copied /etc/resolv.conf intact. nixos-container
           # copies the host's file in at every container start, but
           # resolvconf's host-tracking mode then regenerates it — to an
diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix
index 1dc5d65d..98fed0db 100644
--- a/nix/host-modules/hive-matrix.nix
+++ b/nix/host-modules/hive-matrix.nix
@@ -341,6 +341,13 @@ in
         {
           system.stateVersion = "26.05";
 
+          # Shared host netns: this container's own firewall.service
+          # would rewrite the HOST ruleset (flush nixos-fw, drop the
+          # host's nixos-nat-* chains) at every boot — killing the
+          # bridge DHCP/DNS holes and agent NAT. The host firewall owns
+          # all filtering; never run one in here.
+          networking.firewall.enable = false;
+
           # Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
           # container's trust bundle so tuwunel validates *federation* TLS
           # from a self-signed peer hive (it checks the peer's federation