diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index 4a68cde0..c018bbfb 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -231,10 +231,20 @@ in
 
     forgeTokenFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = if forgeCfg.enable then forgeCfg.hostSwarmControllerTokenFile else null;
+      # `services.hyperhive.swarm.forge` has no `enable` of its own to
+      # check — the module activates on the general
+      # `config.services.hyperhive.enable` instead (see
+      # `hive-forge/default.nix`'s own `config = lib.mkIf
+      # config.services.hyperhive.enable { ... }`), so that's the
+      # condition to match here too. Referencing a `forge.enable` that
+      # doesn't exist threw `attribute 'enable' missing` on every host
+      # that turns swarm-controller on — caught in review, not by
+      # `nix flake check` (nothing in its checked combinations forced
+      # this particular default to actually evaluate).
+      default = if config.services.hyperhive.enable then forgeCfg.hostSwarmControllerTokenFile else null;
       defaultText = lib.literalExpression ''
         forge's own `hostSwarmControllerTokenFile` when this host runs
-        forge, else null
+        hyperhive at all (forge has no separate enable), else null
       '';
       example = "/var/lib/secrets/swarm-controller-forge.token";
       description = ''
@@ -243,15 +253,16 @@ in
         `forgejo-swarm-controller-account` + `hive-forge-swarm-controller-token`
         units, which mint and collect it onto forge's own host).
 
-        Defaults to forge's own delivery path only when forge runs on
-        this same host. On any other host the token has to get here
-        somehow — copy it out of forge's
+        Defaults to forge's own delivery path on every host running
+        hyperhive (forge deploys unconditionally alongside it — see
+        `hive-forge/default.nix`, it has no `enable` of its own).
+        Override explicitly if forge's actual token file ends up
+        somewhere else — copy it out of forge's
         {option}`services.hyperhive.swarm.forge.hostSwarmControllerTokenFile`
         with whatever secret management this deployment already uses,
         the same shape `swarm.nix`'s `clientSecretFile` documents for
-        the analogous cross-host case. `null` (the default when forge
-        isn't local and nothing else was set) means no forge access —
-        the daemon logs that and continues without it, the same
+        its own cross-host case. `null` means no forge access — the
+        daemon logs that and continues without it, the same
         graceful-absence shape the queue coordinates already use.
       '';
     };