diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 16af376a..2a0e1531 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -718,9 +718,21 @@ in
                             "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}"
                           else
                             "${publicScheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
+                        # `m.server` is NOT a URL: per the matrix
+                        # server-server spec (Resolving Server Names) a
+                        # delegated host with NO port resolves to the
+                        # federation default 8448 (after the SRV check) —
+                        # the https-implies-443 rule does NOT apply here.
+                        # So the port must be explicit even when it's the
+                        # HTTPS default; `publicPortSuffix` (which drops
+                        # :443) is right for the client base_url above but
+                        # wrong for federation delegation. Without this,
+                        # peers federate to <gatewayHost>:8448 (closed) while
+                        # the endpoint actually lives on the gateway's 443
+                        # vhost. See docs/gateway.md discovery flow.
                         serverHostPort =
                           if matrixCfg.gatewayHost != null then
-                            "${matrixCfg.gatewayHost}${publicPortSuffix}"
+                            "${matrixCfg.gatewayHost}:${toString publicPort}"
                           else
                             "${hyperhiveDomain}:${toString matrixCfg.httpPort}";
                       in