diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 2376bc35..9ae2899e 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -795,6 +795,13 @@ in
         #   /run/hive-agent        — chown/chmod per-agent socket directories
         #   /run/systemd           — container@ unit drop-ins (resource limits)
         #                            + machinectl / systemd-machined state
+        #   /run/lock              — `nixos-container` opens a lock file at
+        #                            /run/lock/nixos-container to serialise
+        #                            create/destroy. Under ProtectSystem=strict
+        #                            /run is read-only, so without this the very
+        #                            first `nixos-container create` (ruth, on a
+        #                            fresh host) dies with "Read-only file
+        #                            system" before any container exists.
         #   /var/lib/nixos-containers — container rootfs written by nixos-container
         #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
         #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
@@ -806,6 +813,7 @@ in
           "/run/hive"
           "/run/hive-agent"
           "/run/systemd"
+          "/run/lock"
           "/var/lib/nixos-containers"
           "/var/lib/hyperhive"
           "/nix"