diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 42ac308d..aaf686a2 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -720,6 +720,26 @@ in
           state directory.
         '';
       }
+      {
+        assertion =
+          let
+            dir = builtins.dirOf deployCfg.swarm-controller.socketPath;
+          in
+          dir != "/run/hyperhive" && dir != "/run/hive" && dir != "/run";
+        message = ''
+          services.hyperhive.deploy.swarm-controller.socketPath puts the
+          controller socket in
+          ${builtins.dirOf deployCfg.swarm-controller.socketPath}, a
+          directory that carries other sockets.
+
+          The controller socket is 0666 and the gateway's nginx is given
+          its directory, so that directory is the access control.
+          /run/hyperhive holds host.sock — the host ADMIN socket — and
+          /run/hive holds the per-agent and priv sockets. Give the
+          controller a directory of its own (the default,
+          /run/swarm-controller, is one).
+        '';
+      }
     ];
 
     systemd.services.swarm-controller = {