diff --git a/nix/host-modules/lib/hive-ca-trust.nix b/nix/host-modules/lib/hive-ca-trust.nix
index e88065c8..eb0e3744 100644
--- a/nix/host-modules/lib/hive-ca-trust.nix
+++ b/nix/host-modules/lib/hive-ca-trust.nix
@@ -170,13 +170,40 @@ in
               set -euo pipefail
               install -d -m 0755 ${dir}
               tmp=${bundlePath}.tmp
-              cat /etc/ssl/certs/ca-certificates.crt ${source} > "$tmp"
-              # `cat` of an empty or missing-but-mounted source exits 0, so the
-              # result has to be inspected rather than the command trusted.
-              if ! grep -q 'BEGIN CERTIFICATE' "$tmp"; then
-                echo "${unit}: assembled bundle contains no certificate" >&2
+              # Count the HIVE half on its own, before assembling.
+              #
+              # Inspecting the assembled file cannot work: the system store
+              # always holds certificates, so "does the result contain a
+              # certificate" passes unconditionally — including in the one case
+              # worth catching, where this source contributed nothing. And the
+              # public CAs are irrelevant to what this bundle is for: every name
+              # the consumer verifies is issued by our own CA, so a bundle of
+              # nothing but public CAs is, for this purpose, an empty one that
+              # measures as full.
+              #
+              # `grep -c` exits 1 on zero matches and `set -e` is on, hence the
+              # `|| true` — without it the guard would die instead of reporting.
+              contributed=$(grep -c 'BEGIN CERTIFICATE' ${source} || true)
+              if [ "$contributed" -eq 0 ]; then
+                echo "${unit}: ${source} contributed no certificate to the bundle" >&2
                 exit 1
               fi
+              system=$(grep -c 'BEGIN CERTIFICATE' /etc/ssl/certs/ca-certificates.crt || true)
+              cat /etc/ssl/certs/ca-certificates.crt ${source} > "$tmp"
+              # `cat` of a source truncated between the count and the copy still
+              # exits 0, so the result is checked against what both halves
+              # brought rather than merely for being non-empty.
+              total=$(grep -c 'BEGIN CERTIFICATE' "$tmp" || true)
+              if [ "$total" -ne $((system + contributed)) ]; then
+                echo "${unit}: bundle has $total certificates, expected $system + $contributed" >&2
+                exit 1
+              fi
+              # ⚠️ Scope: this proves the anchor was CONTRIBUTED, not that it is
+              # USABLE. A consumer that reads only the first certificate of the
+              # file ignores it anyway — that is what took the swarm collector
+              # down — and no check on this file can see it. Only a real
+              # handshake can. Do not read a green assembly as a working trust
+              # store.
               chmod 0644 "$tmp"
               mv "$tmp" ${bundlePath}
             '';