diff --git a/nix/module-eval/hive-otel.nix b/nix/module-eval/hive-otel.nix
index cf378a95..b085d702 100644
--- a/nix/module-eval/hive-otel.nix
+++ b/nix/module-eval/hive-otel.nix
@@ -650,7 +650,9 @@ let
         && builtins.elem "f ${sq.agentAllowFile} 0640 hive-core squid - -" rules
         && env.HIVE_SQUID_ALLOWED_FILE == sq.allowedFile
         && env.HIVE_SQUID_AGENT_ALLOW_FILE == sq.agentAllowFile
-        && env.HIVE_SQUID_ALLOWED_SEED_FILE == toString sq.allowedSeedFile
+        # The unit's environment holds the seed as a derivation until the unit file
+        # is rendered, so it is compared as a path string.
+        && toString env.HIVE_SQUID_ALLOWED_SEED_FILE == toString sq.allowedSeedFile
         &&
           env.HIVE_SQUID_ALWAYS_ALLOWED == "api.anthropic.com claude.ai platform.claude.com cache.nixos.org";
     }