diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix
index 248695f6..0661aa6b 100644
--- a/nix/host-modules/hive-matrix.nix
+++ b/nix/host-modules/hive-matrix.nix
@@ -798,9 +798,12 @@ in
             # so naming the hive anchor alone would drop every public CA and
             # break federation with the wider matrix network — trading a small
             # outage for a much larger one.
+            # A literal, not an option: this module names its container
+            # `containers.hive-matrix` directly and declares no `machine`
+            # option to derive it from.
             (caTrust.trustBundle {
               inherit pkgs;
-              name = cfg.machine;
+              name = "hive-matrix";
               consumers = [ "tuwunel" ];
             })
           ];