diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix
index e6061327..cc71e5fe 100644
--- a/nix/host-modules/hive-tls.nix
+++ b/nix/host-modules/hive-tls.nix
@@ -693,6 +693,11 @@ in
         pkgs.openssl
         pkgs.coreutils
         pkgs.systemd
+        # `cmp`, which is NOT in coreutils. Without it the root-changed test
+        # below is `command not found` — 127, invisible under `if !`, and
+        # therefore always "changed", so the bundle rebuild it guards fired
+        # on every issuance instead of on a new root.
+        pkgs.diffutils
       ];
       # Sized like the store's own granting units, and for the same
       # reason: under `seal = "shamir"` an operator unseals BY HAND, and