diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix
index 0addddfe..b573a93a 100644
--- a/nix/host-modules/hive-gateway/default.nix
+++ b/nix/host-modules/hive-gateway/default.nix
@@ -310,6 +310,7 @@ in
         forgeCfg
         matrixCfg
         autheliaCfg
+        uiCfg
         hyperhiveDomain
         ;
     };
@@ -334,6 +335,7 @@ in
         ) config.services.hyperhive.swarm.forge.domain
         ++ lib.optional (matrixCfg.enable && matrixCfg.gatewayHost != null) matrixCfg.gatewayHost
         ++ lib.optional autheliaCfg.enable autheliaCfg.domain
+        ++ lib.optional uiCfg.enable uiCfg.domain
       );
     };
   };
diff --git a/nix/host-modules/hive-gateway/dnsmasq.nix b/nix/host-modules/hive-gateway/dnsmasq.nix
index d5096188..cd56e226 100644
--- a/nix/host-modules/hive-gateway/dnsmasq.nix
+++ b/nix/host-modules/hive-gateway/dnsmasq.nix
@@ -11,6 +11,7 @@
   forgeCfg,
   matrixCfg,
   autheliaCfg,
+  uiCfg,
   hyperhiveDomain,
 }:
 {
@@ -60,7 +61,16 @@
     ++ lib.optional (
       matrixCfg.enable && matrixCfg.gatewayHost != null
     ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}"
-    ++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}";
+    ++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}"
+    # The swarm UI's name is the swarm APEX by default — a sibling of
+    # the three above, not a child of anything this resolver already
+    # answers for, so the `/<hive domain>/` rule does not cover it.
+    #
+    # Published to agents deliberately (mara: publishing it is fine).
+    # Reachability is not the access control here: the vhost's
+    # `auth_request` + authelia's `group:operators` rule are, and an
+    # agent that resolves the name still cannot open the page.
+    ++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}";
     # DHCP pool covering all usable host addresses on the bridge
     # subnet — bounds computed by hive-network.nix from
     # bridgeIp/bridgePrefixLength. All containers (agents and service