diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index b3f13f13..71dcb87b 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -481,6 +481,14 @@ in
       # port-forward dance, and the firewall config below is the only
       # layer that matters.
       privateNetwork = false;
+      # dnsmasq refuses to start once a dhcp-range is configured unless it
+      # holds CAP_NET_ADMIN (DNS-only mode doesn't need it). Private-network
+      # containers retain NET_ADMIN implicitly, but this container shares the
+      # host netns (above), so nspawn's default bounding set drops it — grant
+      # it explicitly. Note this is NET_ADMIN over the *host* netns; the
+      # gateway container is trusted infra (it already terminates TLS and
+      # fronts every vhost), so no new trust boundary is crossed.
+      additionalCapabilities = [ "CAP_NET_ADMIN" ];
       # Bind-mount the per-agent socket dir so nginx inside the gateway
       # container can `connect(2)` to the UDS upstreams.
       # Read-only (we just connect; harness writes the socket inside