diff --git a/nix/host-modules/local-defaults.nix b/nix/host-modules/local-defaults.nix
index d1d0e03d..c423672a 100644
--- a/nix/host-modules/local-defaults.nix
+++ b/nix/host-modules/local-defaults.nix
@@ -31,8 +31,9 @@ in
       Run the whole swarm on this host. Turning this on asserts the
       swarm-level toggles that an all-on-one-box deployment implies:
       the swarm's shared services
-      (`services.hyperhive.swarm.enableRequiredServices`) and the swarm
-      CA (`services.hyperhive.swarm.ca.autoConfigure`).
+      (`services.hyperhive.swarm.enableRequiredServices`), the swarm
+      CA (`services.hyperhive.swarm.ca.autoConfigure`), and the swarm
+      controller (`services.hyperhive.swarm.controller.enable`).
 
       **Off by default, and that is the load-bearing part.** A swarm's
       services and its hives can live on different hosts, and a host has
@@ -54,5 +55,13 @@ in
   config.services.hyperhive.swarm = {
     enableRequiredServices = lib.mkDefault cfg.enableAllLocalDefaults;
     ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;
+    # The controller is asserted by the MODE and by nothing else. Its own
+    # option stays `default = false` precisely because running it is a
+    # statement about swarm topology — but "this box is the whole
+    # deployment" IS that statement, and it is the one shape where the
+    # answer isn't ambiguous. Deriving it from `enableRequiredServices`
+    # instead would be wrong: a hive in a larger swarm can legitimately
+    # want the shared services without being the host that controls them.
+    controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
   };
 }
diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 1919ed7c..a848c448 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -60,6 +60,12 @@ in
         deliberately not derived from `services.hyperhive.enable`: a swarm
         has one controller, so enabling it per hive is a decision about
         swarm topology, not about whether hyperhive is installed.
+
+        `services.hyperhive.enableAllLocalDefaults` does assert it, and
+        that is not an exception to the rule above — it is the rule
+        applied. That mode says "this box is the whole deployment", which
+        answers the topology question outright, where
+        `services.hyperhive.enable` alone never can.
       '';
     };