diff --git a/nix/host-modules/default.nix b/nix/host-modules/default.nix
index 1bbee086..8c34c1cc 100644
--- a/nix/host-modules/default.nix
+++ b/nix/host-modules/default.nix
@@ -42,6 +42,7 @@
     ./glue-nats-auth-bao-identity.nix
     ./glue-nats-bao-identity.nix
     ./glue-nats-oidc-client.nix
+    ./glue-nats-wireguard.nix
     ./glue-otel-scrape-targets.nix
     ./glue-queue-agent-credential.nix
     ./glue-builder-oidc-client.nix
diff --git a/nix/host-modules/glue-nats-wireguard.nix b/nix/host-modules/glue-nats-wireguard.nix
new file mode 100644
index 00000000..3423dfb5
--- /dev/null
+++ b/nix/host-modules/glue-nats-wireguard.nix
@@ -0,0 +1,21 @@
+# Glue: where the queue and the wireguard mesh share a host, the queue's port
+# is open on the mesh interface.
+#
+# Interface-scoped, never host-wide: the firewall is default-deny before a
+# packet reaches the listener, so without this no other hive can reach the
+# queue. Gated on BOTH being here — the queue's own module gate
+# (`deploy.nats.enable`) is restated below; a change there must change here.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  deployCfg = hyperhiveCfg.deploy;
+in
+{
+  config = lib.mkIf (deployCfg.nats.enable && deployCfg.wireguard.enable) {
+    networking.firewall.interfaces.wg-hive.allowedTCPPorts = [ hyperhiveCfg.swarm.nats.port ];
+  };
+}
diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 14ef4c7b..5bc0d64a 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -475,14 +475,6 @@ in
     # An agent reaches it by name, which dnsmasq answers with the bridge IP.
     services.hyperhive.network.exposeHostPorts = [ cfg.port ];
 
-    # The other hives' way in, interface-scoped like
-    # ./swarm-snapshot-store.nix's receiver. The firewall is default-deny
-    # before a packet reaches the listener, so without this nothing in-tree
-    # lets another hive reach the queue at all.
-    networking.firewall.interfaces.wg-hive.allowedTCPPorts = lib.mkIf deployCfg.wireguard.enable [
-      cfg.port
-    ];
-
     # The bind source has to exist before the container starts, leaf or not:
     # nixos-container refuses to start over a missing one, which would take
     # the whole queue down rather than only its TLS.