diff --git a/nix/host-modules/local-defaults.nix b/nix/host-modules/local-defaults.nix
index 732c43c7..5034eee5 100644
--- a/nix/host-modules/local-defaults.nix
+++ b/nix/host-modules/local-defaults.nix
@@ -80,15 +80,6 @@ in
     # reach whoever runs the responder, and minting them here would move
     # that hand-off somewhere less visible rather than removing it.
     nats.autoGenerateCallout = lib.mkDefault cfg.enableAllLocalDefaults;
-    # The controller is asserted by the MODE and by nothing else. Its own
-    # option stays `default = false` precisely because running it is a
-    # statement about swarm topology — but "this box is the whole
-    # deployment" IS that statement, and it is the one shape where the
-    # answer isn't ambiguous. Deriving it from `enableRequiredServices`
-    # instead would be wrong: a hive in a larger swarm can legitimately
-    # want the shared services without being the host that controls them.
-    controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
-
     # The controller's queue coordinates. Co-location is what makes these
     # derivable at all — loopback only reaches the queue when the queue is
     # here, and the minted client secret only exists on the host authelia
@@ -117,4 +108,19 @@ in
       lib.mkDefault "${config.services.hyperhive.swarm.authelia.hostClientSecretDir}/swarm-controller.secret"
     );
   };
+
+  # The controller is asserted by the MODE and by nothing else. Its own
+  # option stays `default = false` precisely because running it is a
+  # statement about swarm topology — but "this box is the whole
+  # deployment" IS that statement, and it is the one shape where the
+  # answer isn't ambiguous. Deriving it from `enableRequiredServices`
+  # instead would be wrong: a hive in a larger swarm can legitimately
+  # want the shared services without being the host that controls them.
+  #
+  # Sits outside the `swarm` attrset above because it is a `deploy.*`
+  # option (./deploy.nix): "does THIS host run the controller" is exactly
+  # the per-host fact `swarm.*` may not carry. The ⚠️ collision note above
+  # does not apply here — that one is about two definitions of `swarm`
+  # itself, and this is a different top-level path.
+  config.services.hyperhive.deploy.swarm-controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
 }