diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index c5b619c4..6f2696ee 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -417,6 +417,18 @@ in
           Let's Encrypt needs a contact address for the ACME account.
         '';
       }
+      {
+        assertion =
+          !cfg.hsts.enable
+          || cfg.selfSignedTls
+          || cfg.tls.certDir != null
+          || cfg.tls.acme.enable;
+        message = ''
+          services.hyperhive.gateway.hsts.enable = true requires TLS to be
+          configured (selfSignedTls, tls.certDir, or tls.acme.enable). HSTS
+          over plain HTTP is ignored by browsers and indicates a config error.
+        '';
+      }
     ];
 
     # Ensure bind-mount sources exist at host boot before the gateway