diff --git a/hive-c0re/src/lifecycle/mod.rs b/hive-c0re/src/lifecycle/mod.rs
index 45f4d641..879c4021 100644
--- a/hive-c0re/src/lifecycle/mod.rs
+++ b/hive-c0re/src/lifecycle/mod.rs
@@ -92,9 +92,24 @@ pub fn agent_web_port(name: &str) -> u16 {
 
 /// Number of IP addresses at the top of each subnet reserved for the DHCP
 /// pool (bridge-attached service containers such as hive-ci). Agents are
-/// excluded from this range by the remap in `agent_network_ip`. Must stay
-/// in sync with `dhcpPoolSize` in `nix/modules/hive-gateway.nix`.
-const DHCP_POOL_SIZE: u32 = 14;
+/// excluded from this range by the remap in `agent_network_ip`.
+///
+/// Single source of truth: `nix/dhcp-pool-size` (one integer, shared with
+/// `nix/modules/hive-gateway.nix` which reads the same file via
+/// `builtins.readFile`). Parsed at compile time via `include_bytes!`.
+const DHCP_POOL_SIZE: u32 = {
+    let bytes = include_bytes!("../../../nix/dhcp-pool-size");
+    let mut n: u32 = 0;
+    let mut i = 0;
+    while i < bytes.len() {
+        let b = bytes[i];
+        if b'0' <= b && b <= b'9' {
+            n = n * 10 + (b - b'0') as u32;
+        }
+        i += 1;
+    }
+    n
+};
 
 /// Deterministic IPv4 address for an agent inside an isolated subnet.
 ///
diff --git a/nix/dhcp-pool-size b/nix/dhcp-pool-size
new file mode 100644
index 00000000..8351c193
--- /dev/null
+++ b/nix/dhcp-pool-size
@@ -0,0 +1 @@
+14
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 2e22cf02..dab02e3d 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -15,9 +15,11 @@ let
   # Occupies the last dhcpPoolSize usable addresses of the subnet
   # (e.g. .241-.254 on a /24). Agent containers use deterministic static
   # IPs (lifecycle::agent_network_ip) and are excluded from this range
-  # by a remap in the Rust code. Must stay in sync with DHCP_POOL_SIZE
-  # in hive-c0re/src/lifecycle/mod.rs.
-  dhcpPoolSize = 14;
+  # by a remap in the Rust code.
+  #
+  # Single source of truth: `nix/dhcp-pool-size` (one integer).
+  # Rust reads it at compile time via `include_bytes!` in lifecycle/mod.rs.
+  dhcpPoolSize = lib.strings.toIntBase10 (lib.strings.trim (builtins.readFile ../dhcp-pool-size));
   # IPv4 helpers — nix integers are 64-bit so all /0-/32 values are safe.
   ipToInt =
     ip: