diff --git a/nix/host-modules/otel.nix b/nix/host-modules/otel.nix
index 53d43329..a3024641 100644
--- a/nix/host-modules/otel.nix
+++ b/nix/host-modules/otel.nix
@@ -224,6 +224,22 @@ in
 
       services.opentelemetry-collector = {
         enable = true;
+        # Contrib, matching the swarm tier (./swarm-otel.nix). The upstream
+        # default build has no auth extensions at all, and this tier has to
+        # *present* a credential to the swarm tier — `oauth2client` lives
+        # only in contrib, so the package choice is what makes authenticated
+        # egress expressible rather than a preference.
+        #
+        # Not a build-farm cost: contrib is fetched, not compiled.
+        #
+        # ⚠️ Read the note directly below before adding any extension here.
+        # It describes precisely the trap this package unlocks: naming an
+        # extension the build lacks passes `validate` and then kills the
+        # collector at startup. With contrib the extensions exist — but the
+        # gap it warns about (a green build proving nothing about whether
+        # the process starts) is exactly why this module's auth wiring is
+        # gated by a probe that runs both collectors, not by eval.
+        package = pkgs.opentelemetry-collector-contrib;
         # `validateConfigFile` defaults to `isStorePath configFile`,
         # and `configFile` is null on the `settings` path — so the
         # upstream default is OFF for exactly the way this module