diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 7da5b1c5..1a3f5360 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -1099,11 +1099,18 @@ in
         # and delegates all privileged ops to hive-priv via a Unix socket.
         # These directives deny the subset of kernel capabilities it
         # provably doesn't need without restricting its network or
-        # filesystem access (ProtectSystem / RestrictAddressFamilies are
-        # deferred to a follow-up with a watched deploy.
+        # filesystem access (RestrictAddressFamilies deferred — needs a
+        # watched deploy to verify no AF_UNIX/AF_INET gaps in socket paths).
         NoNewPrivileges = true; # already runs as unprivileged user
-        PrivateTmp = true; # hive-c0re and its nix subprocesses use tmpfiles under StateDirectory, not /tmp
-        ProtectHome = true; # HOME = /var/lib/hyperhive (StateDirectory); no /home/* access needed
+        PrivateTmp = true; # uses StateDirectory for tmpfiles, not /tmp
+        ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed
+        # "full" makes /usr, /etc, /boot read-only. Safe: c0re never
+        # writes to any of those paths directly — all /etc writes (e.g.
+        # /etc/nixos-containers) go through hive-priv, and reads from
+        # /etc/hyperhive/serve.json are read-only. "strict" (everything
+        # read-only) requires carefully auditing ReadWritePaths for every
+        # nix store path c0re touches and is deferred to a follow-up.
+        ProtectSystem = "full";
         ProtectKernelTunables = true; # no sysctl writes
         ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg
         ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly