diff --git a/docs/gateway.md b/docs/gateway.md
index 54f56860..a0b16d63 100644
--- a/docs/gateway.md
+++ b/docs/gateway.md
@@ -97,11 +97,15 @@ now set unconditionally for every agent. The mechanism:
    that haven't yet been rebuilt under the new config.
    The gateway container bind-mounts `/var/lib/hyperhive/gateway/` at
    `/run/hive-state/`; nginx includes `/run/hive-state/agents.conf`.
-   After each write, c0re triggers `nginx -s reload` inside the
-   gateway container from the HOST via
-   `systemd-run --machine=hive-gateway --wait nginx -s reload`. This is
-   intentionally host-side: `IN_MOVED_TO` from an atomic rename does
-   not propagate across the nspawn mount-namespace boundary, so a
+   After each write, c0re triggers the appropriate nginx action inside
+   the gateway container via `hive-priv` (which runs as root and has
+   `--machine=hive-gateway` transport rights that hive-c0re lacks).
+   `hive-priv` queries `ActiveState` and dispatches:
+   - active → `systemctl reload nginx` (SIGHUP, zero-downtime)
+   - failed → `systemctl reset-failed nginx` + `systemctl start nginx`
+   - otherwise → `systemctl start nginx`
+   This is intentionally host-side: `IN_MOVED_TO` from an atomic rename
+   does not propagate across the nspawn mount-namespace boundary, so a
    path unit inside the container would never fire.
 
 c0re regenerates `agents.conf` (and triggers a reload) on two