diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 53ffc9f1..81d00365 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -111,7 +111,7 @@ in
     description = ''
       Whether this container runs as a sub-agent (`"agent"`, the
       default — invokes `hive-ag3nt serve`) or as the swarm's
-      manager (`"manager"` — invokes `hive-m1nd serve` and
+      manager (`"manager"` — invokes `hive-root serve` and
       defaults the forge notification surface to mentions-only).
 
       meta.rs flips this to `"manager"` for the manager container
@@ -690,7 +690,7 @@ in
       }
     ];
 
-    # Per-agent unix user. Runs the hive-ag3nt / hive-m1nd harness +
+    # Per-agent unix user. Runs the hive-ag3nt / hive-root harness +
     # co-process daemons under a non-root principal. UID auto-assigned by
     # NixOS. The container activation script (hive-agent-user-migrate)
     # chowns the bind-mounted state dir — including credential files
@@ -1284,7 +1284,7 @@ in
     # shape (per-role). PATH /bin auto-append behaviour:
     # docs/gotchas.md::systemd.services.*.path appends /bin to
     # every entry.
-    systemd.services.${if config.hyperhive.role == "manager" then "hive-m1nd" else "hive-ag3nt"} =
+    systemd.services.${if config.hyperhive.role == "manager" then "hive-root" else "hive-ag3nt"} =
       let
         isManager = config.hyperhive.role == "manager";
         binary = "hive";
@@ -1319,9 +1319,9 @@ in
         }
         // lib.optionalAttrs isManager {
           # Standalone-eval fallbacks; meta.rs overrides at deploy time.
-          # HIVE_PORT = FNV-1a("hm1nd") % 900 + 8100.
-          HIVE_PORT = "8875";
-          HIVE_LABEL = "hm1nd";
+          # HIVE_PORT = FNV-1a("root") % 900 + 8100.
+          HIVE_PORT = "8273";
+          HIVE_LABEL = "root";
           # Manager always uses a unix socket so the gateway can route
           # /agent/<name>/ to it the same way it routes sub-agents.
           HIVE_WEB_SOCKET = "/run/hive-agent/${userName}/web.sock";