diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 2aa1b879..5c782bcb 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -758,11 +758,13 @@ in
         # See `docs/gateway.md::HIVE_FORGE_URL`.
         # Network isolation is now unconditional (the shared-netns mode was
         # removed), so agents always reach the forge through the gateway
-        # vhost rather than host loopback. The `network.enable` guard remains
-        # only so a deliberately network-less deployment still falls back to
-        # loopback; in the normal case it is always on.
+        # vhost rather than host loopback. Guard on the top-level
+        # `hyperhive.enable` (not the deprecated `network.enable`): the
+        # network is always on with hyperhive, so the deprecated toggle has
+        # no effect here either — the loopback branch only covers a config
+        # with hyperhive itself disabled (no agents to serve).
         HIVE_FORGE_URL =
-          if config.services.hyperhive.network.enable then
+          if config.services.hyperhive.enable then
             "http://${config.services.hyperhive.forge.domain}"
           else
             "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
@@ -772,16 +774,14 @@ in
         # hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL:
         # network isolation is now unconditional, so agents reach tuwunel
         # via the gateway vhost (`matrix.<domain>`) on plain http:80 rather
-        # than host loopback. The gatewayHost null-guard falls back to
-        # loopback so a domain-less config still evals; the `network.enable`
-        # guard covers a deliberately network-less deployment. Forwarded to
-        # agents by meta.rs alongside HIVE_FORGE_URL; shares the same
-        # env-forwarding ordering caveat (value baked at config-generation
-        # time).
+        # than host loopback. Guard on the top-level `hyperhive.enable` (the
+        # deprecated `network.enable` has no effect); the gatewayHost
+        # null-guard falls back to loopback so a domain-less config still
+        # evals. Forwarded to agents by meta.rs alongside HIVE_FORGE_URL;
+        # shares the same env-forwarding ordering caveat (value baked at
+        # config-generation time).
         HIVE_MATRIX_URL =
-          if
-            config.services.hyperhive.network.enable && config.services.hyperhive.matrix.gatewayHost != null
-          then
+          if config.services.hyperhive.enable && config.services.hyperhive.matrix.gatewayHost != null then
             "http://${config.services.hyperhive.matrix.gatewayHost}"
           else
             "http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}";