diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index 8d2f7093..19e892fd 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -16,7 +16,9 @@ let
   # `upload-artifact`, which POSTs to the ROOT_URL-derived artifact endpoint)
   # reject the chain, since Node trusts only its bundled CA bundle, not the
   # system store. Trust the hive CA explicitly via NODE_EXTRA_CA_CERTS below.
-  useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
+  # `gateway.useSelfSigned` is the gateway module's single source of truth
+  # for the self-signed condition (no duplicated derivation here).
+  useSelfSigned = gatewayCfg.useSelfSigned;
   caHostPath = "${tlsCfg.stateDir}/ca.pem";
   caContainerPath = "/run/hive-ca/ca.pem";
 
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 5c870d0c..77a45bc2 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -175,6 +175,23 @@ in
       '';
     };
 
+    useSelfSigned = lib.mkOption {
+      type = lib.types.bool;
+      internal = true;
+      readOnly = true;
+      default = useSelfSigned;
+      defaultText = lib.literalExpression "tls.certDir == null && !tls.acme.enable";
+      description = ''
+        Read-only derived flag: `true` when the gateway serves the
+        self-signed (hive-CA-signed) leaf — i.e. neither `tls.certDir` nor
+        `tls.acme.enable` is configured. Single source of truth for the
+        self-signed condition; consumed by the `hive-tls` and `hive-ci`
+        modules so the derivation isn't duplicated. Internal — not meant to
+        be set by operators (use `tls.certDir` / `tls.acme` to override the
+        self-signed default).
+      '';
+    };
+
     httpsPort = lib.mkOption {
       type = lib.types.port;
       default = 443;
diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index b7716c5d..e2a6d791 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -13,11 +13,10 @@ let
   # The host-managed hive CA is the trust anchor for self-signed mode.
   # It is only stood up when the gateway actually serves a self-signed
   # cert: a domain must be set (the leaf SANs derive from it) and the
-  # gateway must be in self-signed mode — i.e. neither an operator cert
-  # (`tls.certDir`) nor ACME is configured. With either of those the
-  # public/operator CA already validates, so the hive CA is unnecessary.
-  useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
-  active = hyperhiveCfg.enable && useSelfSigned && domain != null;
+  # gateway must be in self-signed mode. The self-signed condition is the
+  # gateway module's single source of truth (`gateway.useSelfSigned`):
+  # true when neither an operator cert (`tls.certDir`) nor ACME is set.
+  active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned && domain != null;
 in
 {
   # Host-side TLS trust root for the self-signed gateway mode.