diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index acc40610..678dfcdc 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -1104,9 +1104,20 @@ in
                 # (see its own comment) — so an existing deployment needs
                 # its token file deleted to force a re-mint with the new
                 # scope.
+                #
+                # Token name carries a timestamp suffix rather than the
+                # fixed `swarm-controller-boot` this used to be — a real
+                # incident, not a hypothetical: deleting the token *file*
+                # (the remediation above) doesn't delete the token Forgejo
+                # already has under that name, so re-running this unit hit
+                # "Command error: access token name has been used already"
+                # and failed outright. Same fix `hive-c0re::forge::users::
+                # mint_token` already uses for its own agent tokens, for
+                # the identical reason — a monotonic suffix means a re-mint
+                # can never collide with whatever this account already has.
                 out=$(forgejo admin user generate-access-token \
                   --username ${lib.escapeShellArg swarmControllerForgeUser} \
-                  --token-name swarm-controller-boot \
+                  --token-name "swarm-controller-boot-$(date +%s)" \
                   --scopes "write:repository,write:organization,write:issue,read:user,write:admin")
                 token=$(printf '%s' "$out" | grep -oE '[0-9a-f]{32,}' | head -n1)
                 if [ -z "$token" ]; then