diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index a70daee2..9925aeb9 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -207,9 +207,8 @@ in
         `auth_basic` module handles credential validation — no extra
         service or host-side daemon required. Off by default.
 
-        Create the file with: `htpasswd -Bc /path/to/gateway.htpasswd <username>`
-        (BCrypt recommended; `-c` creates a new file). Subsequent users:
-        `htpasswd -B /path/to/gateway.htpasswd <user2>`.
+        Manage users with `hivectl gateway create-user`, `delete-user`,
+        and `list-users` — see `hivectl gateway --help` for usage.
       '';
 
       htpasswdFile = lib.mkOption {
@@ -223,8 +222,9 @@ in
           container at `/run/gateway-auth/`. The file must be readable by
           the `nginx` user inside the container (mode 0644 recommended).
 
-          Create with: `htpasswd -Bc <file> <username>`. BCrypt (`-B`) is
-          strongly preferred over the legacy MD5/SHA1 algorithms.
+          Manage with: `hivectl gateway create-user --file <path> <username>`.
+          BCrypt (cost 12) is used by default; no external `htpasswd` binary
+          required.
 
           Required when `enable = true`.
         '';