diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index f85eb089..87d1a50d 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -991,12 +991,22 @@ in
               set -euo pipefail
 
               # Idempotent by query, same reasoning as the SSO unit: assert
-              # the effect, not the command's exit code.
+              # the effect, not the command's exit code. `--admin`: the
+              # controller creates repos in the agents org on the swarm's
+              # behalf, which needs org-admin standing to do at all. Only
+              # applies to a fresh account — `forgejo admin` has no
+              # in-place "promote to admin" verb (checked: `admin user`
+              # offers create/list/change-password/delete/
+              # generate-access-token/must-change-password/reset-mfa and
+              # nothing else), and mara's call was not to delete+recreate
+              # an already-provisioned non-admin account to work around
+              # that (every hive from before this fix has one) — she
+              # promotes those by hand instead.
               if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then
                 forgejo admin user create \
                   --username ${lib.escapeShellArg swarmControllerForgeUser} \
                   --email ${lib.escapeShellArg "${swarmControllerForgeUser}@hyperhive.local"} \
-                  --random-password --must-change-password=false
+                  --admin --random-password --must-change-password=false
                 echo "created forge account ${swarmControllerForgeUser}"
               fi
               if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then