diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 52fc2cd8..7f2f8fb7 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -973,6 +973,7 @@ in
           };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config ${serveConfig}";
+        SyslogIdentifier = "hive-c0re";
         # Migrate hive-c0re's *own* state to the service user after an
         # upgrade from a root-run install (systemd's StateDirectory only
         # chowns the top-level dir, not pre-existing files inside it). The
@@ -1109,6 +1110,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/hive-priv";
+        SyslogIdentifier = "hive-priv";
         Type = "simple";
         User = "root";
         PrivateTmp = true;
diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index 47f45906..7d07ec06 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -319,6 +319,9 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         ExecStart = prefetchScript;
+        # Pin the journal identity; ExecStart is a writeShellScript whose
+        # store-path basename would otherwise be the journal identifier.
+        SyslogIdentifier = "hive-ci-prefetch";
       };
     };
 
diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index ae0bd45c..ca30c11f 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -364,6 +364,8 @@ in
               Type = "oneshot";
               User = "forgejo";
               Group = "forgejo";
+              # Pin the journal identity (else it's the `script` store-path wrapper).
+              SyslogIdentifier = "forgejo-gpg-init";
             };
             # GNUPGHOME = the keyring forgejo signs from; HOME so
             # `git config --global` lands where the forgejo process reads it.
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 67154a7e..bde98ac3 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -830,6 +830,8 @@ in
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
+              # Pin the journal identity (else it's the `script` store-path wrapper).
+              SyslogIdentifier = "hive-gateway-self-signed-cert";
             };
             path = [ pkgs.coreutils ];
             script = ''
diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index b55533d8..2f38bdd6 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -100,6 +100,8 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         UMask = "0077";
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "hive-tls-ca";
       };
       script = ''
         set -euo pipefail
diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 355b5f1f..d198a909 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1270,6 +1270,9 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity; without it systemd derives it from the
+        # generated `script` store-path wrapper (an opaque `<hash>-…-start`).
+        SyslogIdentifier = "hyperhive-isolated-dns";
       };
       path = [ pkgs.coreutils ];
       script = ''
@@ -1294,6 +1297,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "tea-login";
       };
       path = [
         pkgs.curl
@@ -1371,6 +1376,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = false;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "forge-avatar-sync";
       };
       path = [
         pkgs.curl
@@ -1469,6 +1476,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${pkgs.hyperhive}/bin/hive-matrix-daemon";
+        SyslogIdentifier = "hive-matrix-daemon";
         Restart = "on-failure";
         RestartSec = 5;
         User = userName;
@@ -1524,6 +1532,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${pkgs.hyperhive}/bin/hive-bash-daemon";
+        SyslogIdentifier = "hive-bash-daemon";
         Restart = "on-failure";
         RestartSec = 3;
         User = userName;
@@ -1577,6 +1586,8 @@ in
         # RemainAfterExit = false so the .path trigger can re-fire
         # the unit (see docs/persistence.md::matrix-avatar-sync).
         RemainAfterExit = false;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "matrix-avatar-sync";
       };
       path = [
         pkgs.curl
@@ -1679,6 +1690,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "hive-dashboard-links";
       };
       environment.LINKS_JSON = builtins.toJSON config.hyperhive.dashboardLinks;
       script = ''
diff --git a/nix/templates/weston-vnc.nix b/nix/templates/weston-vnc.nix
index 1d9a7c57..bd68cdf6 100644
--- a/nix/templates/weston-vnc.nix
+++ b/nix/templates/weston-vnc.nix
@@ -136,6 +136,10 @@ in
             --socket=wayland-0 \
             --disable-transport-layer-security
         '';
+        # ExecStart is already a direct `weston` exec (basename is clean), but
+        # pin the identity explicitly so it can't drift if a wrapper is ever
+        # introduced (sweep per the systemd SyslogIdentifier convention).
+        SyslogIdentifier = "weston";
         Restart = "on-failure";
         RestartSec = "5s";
       };