diff --git a/nix/host-modules/hive-c0re/default.nix b/nix/host-modules/hive-c0re/default.nix
index 83c753f4..ddcb674f 100644
--- a/nix/host-modules/hive-c0re/default.nix
+++ b/nix/host-modules/hive-c0re/default.nix
@@ -13,6 +13,20 @@
 let
   cfg = config.services.hyperhive.c0re;
 
+  # `/run/hyperhive`'s mode. Held in one place because whichever of the two
+  # units below activates first creates the directory, so they cannot be
+  # allowed to disagree about what it should be. `0751` is traverse-only, no
+  # listing: `hive-admin` members reach `host.sock` without root, while the
+  # socket's own `0660 hive-admin` gates the connection and the per-agent
+  # subdirs keep their own perms.
+  #
+  # hive-priv writes a tmpfiles.d entry for this same path and cannot read
+  # this binding, so the two are kept in step by hand. Divergence is not
+  # cosmetic: tmpfiles then tries to fchmod a directory hive-priv has no
+  # write access to, the whole `--create` run fails, and a single WARN per
+  # sync is the only symptom.
+  runtimeDirMode = "0751";
+
   baoDeploy = config.services.hyperhive.deploy.bao;
   # Held in one place because the LoadCredential below and the `BAO_*`
   # environment in ./environment.nix have to agree on when they exist: a
@@ -313,12 +327,7 @@ in
         Group = "hive-core";
         SupplementaryGroups = [ "systemd-journal" ];
         RuntimeDirectory = "hyperhive";
-        # 0751 (traverse-only, no listing) so `hive-admin` operators can reach
-        # the host admin socket (`SocketGroup = "hive-admin"`, 0660) without
-        # root. Others can traverse but not list; the socket + per-agent
-        # subdirs gate access by their own perms. Matches the socket unit's
-        # DirectoryMode.
-        RuntimeDirectoryMode = "0751";
+        RuntimeDirectoryMode = runtimeDirMode;
         RuntimeDirectoryPreserve = "yes";
         StateDirectory = "hyperhive";
         StateDirectoryMode = "0750";
@@ -416,12 +425,9 @@ in
         # so it stays effectively root-only. See docs/trust-boundary/boundary.md.
         SocketMode = "0660";
         SocketGroup = "hive-admin";
-        # `0751` (traverse-only, no listing) so hive-admin can reach the socket
-        # path — the socket's own `0660 hive-admin` gates the connection, and
-        # the per-agent subdirs under here keep their own restrictive perms.
-        # Must match the service unit's RuntimeDirectoryMode. DirectoryMode is
-        # only consulted when the dir is absent at socket-unit activation.
-        DirectoryMode = "0751";
+        # Only consulted when the directory is absent at socket-unit
+        # activation — i.e. when this unit wins the race with the service.
+        DirectoryMode = runtimeDirMode;
       };
     };
   };