diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index 19e892fd..a4168136 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -480,8 +480,24 @@ in
                 # only bites in the post-restart cold window. Non-fatal shape:
                 # if it never comes up the unit fails cleanly (recoverable)
                 # rather than the runner claiming jobs into a dead daemon.
+                #
+                # `--store daemon` is load-bearing. A bare `nix store ping`
+                # uses the `auto` store, which — when run as root with the
+                # daemon socket absent — silently resolves to a LOCAL store
+                # (root can write /nix/store directly) and pings successfully.
+                # systemd service units don't source the profile that sets
+                # `NIX_REMOTE=daemon`, so this is the real environment here.
+                # At cold boot the daemon socket IS absent: nix-daemon.socket
+                # carries `ConditionPathIsReadWrite=/nix/var/nix/daemon-socket`
+                # and is condition-skipped until /nix/var goes read-write. So
+                # a bare ping would pass against the local store while the
+                # daemon is still down — defeating the gate's whole purpose
+                # (the runner would start and claim jobs the daemon can't yet
+                # service). Pinning `--store daemon` makes the poll verify the
+                # actual daemon socket, so the gate honours its contract and
+                # waits until the daemon — not a local fallback — answers.
                 for _ in $(seq 1 90); do
-                  if ${pkgs.nix}/bin/nix store ping >/dev/null 2>&1; then
+                  if ${pkgs.nix}/bin/nix store ping --store daemon >/dev/null 2>&1; then
                     exit 0
                   fi
                   sleep 2