diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 0967fafe..2cc01ce6 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -535,6 +535,28 @@ in
           # all filtering; never run one in here.
           networking.firewall.enable = false;
 
+          # Teach this container the SSO name, because nothing else will.
+          #
+          # The hive's dnsmasq is authoritative for the swarm service
+          # names, but only containers whose resolv.conf points at the
+          # bridge ask it — agent containers do, by an explicit unit
+          # (`nix/agent-modules/network.nix`) written for exactly this
+          # reason. This container resolves through the host's resolvers
+          # instead, and the swarm domain has no public records, so
+          # `admin auth add-oauth` fails at discovery with "no such
+          # host" while the same name resolves fine one container over.
+          #
+          # `127.0.0.1` rather than the bridge IP: sharing the host netns
+          # means loopback IS the host, where nginx serves this vhost.
+          # TLS still validates — the CA trust bundle is bind-mounted
+          # above, and the leaf covers this name.
+          #
+          # Only when THIS host runs authelia. With a remote provider the
+          # name belongs to another machine and must resolve normally.
+          networking.hosts = lib.mkIf ssoLocal {
+            "127.0.0.1" = [ autheliaCfg.domain ];
+          };
+
           services.forgejo = {
             enable = true;
             package = cfg.package;