diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix
index 8c7e96af..3968438b 100644
--- a/nix/host-modules/swarm-ui.nix
+++ b/nix/host-modules/swarm-ui.nix
@@ -22,21 +22,21 @@ let
   # this UI was left out of that overlay entirely (an operator with a
   # stylix-themed host saw the dashboard in their own colours but this
   # UI still on the default Catppuccin palette), because nothing here
-  # ever wrote a themed `colors.css` over `cfg.package` before serving
-  # it; the c0re-side overlay only ever touched `dashboard/`/`agent/`.
-  # Detection + CSS-generation is shared (`./stylix-theme.nix`);
-  # `servedPackage` is this module's own overlay-onto-`cfg.package`
-  # consumer, same shape as `theme.nix`'s `themedFrontend`.
+  # ever served a themed `colors.css` in place of `cfg.package`'s own.
+  # Detection + CSS-generation is shared (`./stylix-theme.nix`).
+  #
+  # No package-copy derivation: this vhost has exactly one location
+  # serving `cfg.package` (unlike hive-c0re's `servedFrontend`, which
+  # backs both the dashboard root AND every per-agent gateway route, so
+  # a single swapped tree covers both) — an `= /static/colors.css`
+  # exact-match location overriding just that one file, same idiom
+  # every other single-path override on this vhost already uses
+  # (`/api/whoami`, `/api/docs`), is simpler than copying the whole
+  # static tree to change one file inside it. mara, on review: "i
+  # thought we just swap a css file via nginx config?" — yes, and this
+  # is that.
   stylixTheme = import ./stylix-theme.nix { inherit lib config pkgs; };
   inherit (stylixTheme) stylixThemeColors themedColorsCss;
-  themedPackage =
-    c:
-    pkgs.runCommand "hyperhive-swarm-ui-themed" { } ''
-      cp -r ${cfg.package} $out
-      chmod -R u+w $out
-      install -m644 ${themedColorsCss c} $out/static/colors.css
-    '';
-  servedPackage = if stylixThemeColors != null then themedPackage stylixThemeColors else cfg.package;
 
   # Repeated verbatim by every location that should be operator-gated
   # (`/`, `/api/`, `/api/docs/`) rather than set once on the server:
@@ -191,7 +191,7 @@ in
         extraConfig = gatewayCfg.lib.securityHeaders;
         locations = {
           "/" = {
-            root = "${servedPackage}";
+            root = "${cfg.package}";
             extraConfig = ''
               ${swarmAuthRequest}
               # SPA: any path the bundle routes client-side is served the
@@ -199,6 +199,23 @@ in
               try_files $uri /index.html;
             '';
           };
+        }
+        // lib.optionalAttrs (stylixThemeColors != null) {
+          # Stylix theming (see the `let` block above): overrides just
+          # this one file from `cfg.package`'s own static root, rather
+          # than copying the whole tree to change one file inside it —
+          # nginx resolves the more specific `=` exact match over the
+          # `/` prefix root above, so this simply doesn't exist (falling
+          # through to the package's own untouched colors.css) when
+          # there's no active palette. Same `auth_request` gate as every
+          # other location here — no reason for this one path to have a
+          # different failure mode than the page that loads it.
+          "= /static/colors.css" = {
+            alias = "${themedColorsCss stylixThemeColors}";
+            extraConfig = swarmAuthRequest;
+          };
+        }
+        // {
           # swarm-controller's whole HTTP surface, including the live
           # `/api/openapi.json` spec — proxied untouched (no URI segment
           # after the socket path, same "pass the request through as-is"