diff --git a/hive-c0re/src/forge/users.rs b/hive-c0re/src/forge/users.rs
index 4d6c20f2..085f9a1f 100644
--- a/hive-c0re/src/forge/users.rs
+++ b/hive-c0re/src/forge/users.rs
@@ -15,10 +15,10 @@ use reqwest::StatusCode;
 use super::{CONFIG_ORG, api, forge_admin, is_present};
 
 const TOKEN_NAME_PREFIX: &str = "hyperhive";
-/// Where the host-side `core` admin token lives. Used by hive-c0re
-/// itself to push the meta repo + drive admin API calls (org
-/// creation, future webhook setup, etc.). Root-only.
-const CORE_TOKEN_PATH: &str = "/var/lib/hyperhive/forge-core-token";
+// Where the host-side `core` admin token lives. Used by hive-c0re itself
+// to push the meta repo + drive admin API calls. Root-only. Literal lives
+// in `crate::paths`; aliased here under the long-standing name.
+use crate::paths::FORGE_CORE_TOKEN as CORE_TOKEN_PATH;
 // Forge provisioning markers (`forge/core-avatar-set`,
 // `forge/agent-configs-avatar-set`, `forge/email-aligned-<name>`) live
 // in `crate::paths` — one-shot guards: the upload/align runs once, the
diff --git a/hive-c0re/src/paths.rs b/hive-c0re/src/paths.rs
index 739ae9e3..a3b60844 100644
--- a/hive-c0re/src/paths.rs
+++ b/hive-c0re/src/paths.rs
@@ -209,12 +209,11 @@ pub fn shared_root() -> PathBuf {
     state_root().join("shared")
 }
 
-/// `knowledge/` — local checkout of the `internal/knowledge` repo.
+/// `knowledge/` — local checkout of the `internal/knowledge` repo. A
+/// `&str` (used as a git `-C` arg / clone target throughout the knowledge
+/// worker), so it stays a const rather than a `PathBuf` fn.
 // nix: bind-mounted read-only into agent containers as `/knowledge` (harness-base.nix) — must match.
-#[must_use]
-pub fn knowledge_dir() -> PathBuf {
-    state_root().join("knowledge")
-}
+pub const KNOWLEDGE_DIR: &str = "/var/lib/hyperhive/knowledge";
 
 /// `gateway/` — generated nginx include fragments for the gateway vhost.
 // nix: bind-mounted into the gateway container (hive-gateway.nix) — must match.
@@ -229,12 +228,11 @@ pub fn gateway_agents_conf() -> PathBuf {
     gateway_dir().join("agents.conf")
 }
 
-/// `forge-core-token` — the hive-c0re forge account API token.
+/// `forge-core-token` — the hive-c0re forge account API token. A `&str`
+/// (used in `Path::new` + user-facing `format!` messages), so it stays a
+/// const rather than a `PathBuf` fn.
 // nix: bind-mounted into the forge container / read at provisioning (hive-forge.nix) — must match.
-#[must_use]
-pub fn forge_core_token() -> PathBuf {
-    state_root().join("forge-core-token")
-}
+pub const FORGE_CORE_TOKEN: &str = "/var/lib/hyperhive/forge-core-token";
 
 /// `matrix-register-token` — shared matrix registration token.
 // nix: bind-mounted into the tuwunel/matrix container (hive-matrix.nix) — must match.
diff --git a/hive-c0re/src/workers/knowledge.rs b/hive-c0re/src/workers/knowledge.rs
index c3647b42..8e535298 100644
--- a/hive-c0re/src/workers/knowledge.rs
+++ b/hive-c0re/src/workers/knowledge.rs
@@ -23,7 +23,9 @@ pub const REPO: &str = "knowledge";
 
 /// Host-side path for the local clone. Also referenced from
 /// `lifecycle.rs` (bind-mount source) and the dashboard webhook handler.
-pub const LOCAL_DIR: &str = "/var/lib/hyperhive/knowledge";
+/// The literal lives in [`crate::paths`]; re-exported here under the name
+/// this module and its consumers have always used.
+pub use crate::paths::KNOWLEDGE_DIR as LOCAL_DIR;
 
 /// In-container mount point for the knowledge repo. Bind-mounted
 /// read-only from [`LOCAL_DIR`] into every agent container.