diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 027d9667..41eb3722 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -99,8 +99,10 @@ let
   unitName = "authelia-${instance}";
   stateDir = "/var/lib/${unitName}";
 
-  tlsCfg = deployCfg.hive-controller.tls;
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
   # `swarm-authelia-bridge` verifies the gateway when it introspects by name.
   # Nothing in this container trusted the swarm CA, which is a runtime file no
   # build-time option can name — so an https call out of here could only ever
diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index df6f45f6..6c6d37f4 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -20,13 +20,15 @@ let
   networkCfg = config.services.hyperhive.network;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = hyperhiveCfg.gateway;
-  tlsCfg = deployCfg.hive-controller.tls;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   vmCfg = hyperhiveCfg.swarm.victoriametrics;
   vlCfg = hyperhiveCfg.swarm.victorialogs;
   swarmDomain = hyperhiveCfg.swarm.domain;
 
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
 
   # Spelled ONCE. The provisioned datasource declares it and every panel in the
   # provisioned dashboards references it; a second literal would be free to