diff --git a/hive-c0re/src/main.rs b/hive-c0re/src/main.rs
index c59450ff..85c757f7 100644
--- a/hive-c0re/src/main.rs
+++ b/hive-c0re/src/main.rs
@@ -292,13 +292,10 @@ async fn cmd_serve(
             tracing::warn!(error = ?e, "auto-update task failed");
         }
     });
-    // Forge user sweep: ensure every existing container has a
-    // forgejo user + access token. No-op when the hive-forge
-    // container isn't running. Backgrounded — touches the
-    // forge state dir via `nixos-container run` which is slow.
-    tokio::spawn(async move {
-        forge::ensure_all().await;
-    });
+    // Forge user sweep: now a `NodeKind::ForgeSweep` DAG node (see
+    // `workers::auto_update::submit_startup_sweep_nodes`), submitted
+    // unconditionally on every boot — moved off a bare `tokio::spawn` so it
+    // shows as real work on the dashboard.
     // Webhook HMAC secret: load from state dir or generate on first run.
     // Used by both the webhook handlers (verification) and the Forgejo
     // hook registrations (so Forgejo signs deliveries with the same key).
@@ -312,38 +309,13 @@ async fn cmd_serve(
             None
         }
     };
-    // Webhook setup: ensure Forgejo webhooks are registered for both
+    // Webhook setup: now a `NodeKind::WebhookRegister` DAG node (see
+    // `workers::auto_update::submit_startup_sweep_nodes`), registering both
     // `internal/knowledge` (push → git pull) and the `agent-configs` org
-    // (pull_request → queue MergeConfigPr approval). Both run after
-    // forge::ensure_all so the core token + repos + org are present.
-    // URLs use the public hive domain (HYPERHIVE_HIVE_DOMAIN) so Forgejo
-    // delivers through the gateway, bypassing the SSRF loopback guard.
-    // No-op when the core token or domain are absent, or when the HMAC
-    // secret is unavailable (load failure).
-    let webhook_secret_reg = webhook_secret.clone();
-    tokio::spawn(async move {
-        let Some(webhook_secret_reg) = webhook_secret_reg else {
-            tracing::debug!("webhook secret unavailable; skipping hook registration");
-            return;
-        };
-        let Some(token) = forge::core_token() else {
-            return;
-        };
-        let domain = std::env::var("HYPERHIVE_HIVE_DOMAIN")
-            .ok()
-            .filter(|v| !v.is_empty());
-        let Some(domain) = domain else {
-            tracing::debug!("HYPERHIVE_HIVE_DOMAIN unset; skipping webhook registration");
-            return;
-        };
-        if let Err(e) = knowledge::ensure_webhook(&token, &domain, &webhook_secret_reg).await {
-            tracing::warn!(error = ?e, "knowledge: ensure_webhook failed");
-        }
-        if let Err(e) = forge::ensure_config_pr_webhook(&token, &domain, &webhook_secret_reg).await
-        {
-            tracing::warn!(error = ?e, "forge: ensure_config_pr_webhook failed");
-        }
-    });
+    // (pull_request → queue MergeConfigPr approval) hooks. Its executor
+    // re-derives the core token / hive domain / HMAC secret itself, mirroring
+    // the guard chain that used to live here — see `job_queue::exec::
+    // run_webhook_register`.
     // Config-PR polling fallback: scan agent-configs org every 5 minutes
     // for open PRs that have no pending MergeConfigPr approval. Catches
     // anything the webhook missed (c0re was down when PR opened, delivery