diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index de95ad87..48b02b7f 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -113,7 +113,7 @@ See `retentionPeriod` below before leaving it at its default.
 
 | Option | When you'd touch it |
 |---|---|
-| `swarm.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you cannot get back. |
+| `deploy.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you cannot get back. |
 | `swarm.grafana.oidc.role` | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who should not be able to reconfigure Grafana. |
 | `swarm.grafana.datasourceUrl` | Only if you front VictoriaMetrics with something else. It defaults to the store on this host, which is the only thing it can reach. |
 
@@ -144,7 +144,7 @@ swarm.
 
 | Option | When you'd touch it |
 |---|---|
-| `swarm.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are usually read within days of being written. Raise it if you need to answer questions about last quarter. |
+| `deploy.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are usually read within days of being written. Raise it if you need to answer questions about last quarter. |
 | `swarm.victorialogs.domain` | Only to rename it. |
 | `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
 
diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index e0d56d6c..1645f3c7 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -97,6 +97,19 @@ in
       [ "services" "hyperhive" "swarm" "forge" "ci" "package" ]
       [ "services" "hyperhive" "deploy" "forgejo" "ci" "package" ]
     )
+
+    # Retention is read only where the container is defined, so it is a
+    # decision of the host running the store rather than something the swarm
+    # agrees on. The two stores keep everything else — package, domain, port
+    # — in `swarm.*`, because a client hive needs those to reach them.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "victoriametrics" "retentionPeriod" ]
+      [ "services" "hyperhive" "deploy" "victoriametrics" "retentionPeriod" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "victorialogs" "retentionPeriod" ]
+      [ "services" "hyperhive" "deploy" "victorialogs" "retentionPeriod" ]
+    )
   ];
 
   # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the
diff --git a/nix/host-modules/swarm-victorialogs.nix b/nix/host-modules/swarm-victorialogs.nix
index aadd8ec3..bdadcbcb 100644
--- a/nix/host-modules/swarm-victorialogs.nix
+++ b/nix/host-modules/swarm-victorialogs.nix
@@ -53,9 +53,9 @@ let
   '';
 in
 {
-  # `enable` moved to `services.hyperhive.deploy.victorialogs.enable` — see
-  # ./deploy.nix. What stays here is what the store IS: its package,
-  # domain, retention and wiring.
+  # What stays here is what the store IS from any hive's point of view: its
+  # package, the name it answers on, the port. `enable` and `retentionPeriod`
+  # are decisions of the host that runs it and live under `deploy.*`.
   options.services.hyperhive.swarm.victorialogs = {
     package = lib.mkOption {
       type = lib.types.package;
@@ -106,19 +106,25 @@ in
       '';
     };
 
-    retentionPeriod = lib.mkOption {
-      type = lib.types.str;
-      default = "30d";
-      example = "90d";
-      description = ''
-        How long log data is kept.
+  };
 
-        Deliberately far shorter than the metrics store's retention: logs
-        are orders of magnitude larger per unit of time, and their value
-        decays much faster. A log line answers "what happened during that
-        incident"; a metric answers "is this worse than last quarter".
-      '';
-    };
+  # Retention is a property of the store this host runs, not something the
+  # swarm has to agree on: it is read only where the container is defined,
+  # and a hive that is a *client* of the log store never consults it. That
+  # makes it a `deploy.*` value by the same rule as the seal on the secret
+  # store — options on the auto-deployed service itself.
+  options.services.hyperhive.deploy.victorialogs.retentionPeriod = lib.mkOption {
+    type = lib.types.str;
+    default = "30d";
+    example = "90d";
+    description = ''
+      How long log data is kept.
+
+      Deliberately far shorter than the metrics store's retention: logs
+      are orders of magnitude larger per unit of time, and their value
+      decays much faster. A log line answers "what happened during that
+      incident"; a metric answers "is this worse than last quarter".
+    '';
   };
 
   config = lib.mkIf (hyperhiveCfg.enable && deployCfg.victorialogs.enable) {
@@ -235,7 +241,7 @@ in
             # boundary.
             listenAddress = "127.0.0.1:${toString cfg.port}";
 
-            extraOptions = [ "-retentionPeriod=${cfg.retentionPeriod}" ];
+            extraOptions = [ "-retentionPeriod=${deployCfg.victorialogs.retentionPeriod}" ];
           };
         };
     };
diff --git a/nix/host-modules/swarm-victoriametrics.nix b/nix/host-modules/swarm-victoriametrics.nix
index 3fa29305..e9b7dd29 100644
--- a/nix/host-modules/swarm-victoriametrics.nix
+++ b/nix/host-modules/swarm-victoriametrics.nix
@@ -29,9 +29,9 @@ let
   domainBase = if swarmDomain == null then "invalid" else swarmDomain;
 in
 {
-  # `enable` moved to `services.hyperhive.deploy.victoriametrics.enable` — see
-  # ./deploy.nix. What stays here is what the store IS: its package,
-  # domain, retention and wiring.
+  # What stays here is what the store IS from any hive's point of view: its
+  # package, the name it answers on, the port. `enable` and `retentionPeriod`
+  # are decisions of the host that runs it and live under `deploy.*`.
   options.services.hyperhive.swarm.victoriametrics = {
     package = lib.mkOption {
       type = lib.types.package;
@@ -73,21 +73,25 @@ in
       '';
     };
 
-    retentionPeriod = lib.mkOption {
-      type = lib.types.str;
-      default = "5y";
-      example = "90d";
-      description = ''
-        How long samples are kept.
+  };
 
-        Deliberately a high default rather than a required option: the two
-        failure directions are not symmetric. Too long fills a disk, which
-        is visible and recoverable by lowering this; too short **destroys
-        history**, silently and permanently. So the safe default is generous
-        and an operator lowers it once they have measured how fast this swarm
-        actually accumulates data.
-      '';
-    };
+  # Retention is a property of the store this host runs, not something the
+  # swarm has to agree on: it is read only where the container is defined,
+  # and a hive that is a *client* of the metrics store never consults it.
+  options.services.hyperhive.deploy.victoriametrics.retentionPeriod = lib.mkOption {
+    type = lib.types.str;
+    default = "5y";
+    example = "90d";
+    description = ''
+      How long samples are kept.
+
+      Deliberately a high default rather than a required option: the two
+      failure directions are not symmetric. Too long fills a disk, which
+      is visible and recoverable by lowering this; too short **destroys
+      history**, silently and permanently. So the safe default is generous
+      and an operator lowers it once they have measured how fast this swarm
+      actually accumulates data.
+    '';
   };
 
   config = lib.mkIf (hyperhiveCfg.enable && deployCfg.victoriametrics.enable) {
@@ -165,7 +169,7 @@ in
           services.victoriametrics = {
             enable = true;
             package = cfg.package;
-            retentionPeriod = cfg.retentionPeriod;
+            retentionPeriod = deployCfg.victoriametrics.retentionPeriod;
 
             # ⚠️ PINNED TO LOOPBACK, and this is a correction rather than a
             # preference: upstream's default is `:8428`, i.e. every