diff --git a/docs/scheduler/ci.md b/docs/scheduler/ci.md
index 50df5869..ce2261a1 100644
--- a/docs/scheduler/ci.md
+++ b/docs/scheduler/ci.md
@@ -169,8 +169,8 @@ the forge admin panel as offline until an admin deletes it.
 
 <!-- vale write-good.Passive = NO -->
 
-With `services.hyperhive.deploy.forgejo.actionsFromSelf` set on the forge's
-host, the swarm controller seeds an `actions/checkout` pull-mirror on the forge
+With `services.hyperhive.deploy.forgejo.actionsFromSelf` enabled (the default)
+on the forge's host, the swarm controller seeds an `actions/checkout` pull-mirror on the forge
 and Forgejo's `DEFAULT_ACTIONS_URL` points at the forge itself. CI
 `uses: actions/checkout@vN` steps then resolve on the forge, with no external
 DNS on the CI critical path.
diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index 9fcebbc1..40e280b0 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -53,8 +53,8 @@ let
 
         The runner registers as a new runner on the forge, so delete the old
         one in the forge's admin panel (Site administration, Actions, Runners).
-        To keep resolving `uses: actions/checkout` from the forge, set
-        services.hyperhive.deploy.forgejo.actionsFromSelf = true on its host.
+        The forge keeps resolving `uses: actions/checkout` from itself unless
+        services.hyperhive.deploy.forgejo.actionsFromSelf is false on its host.
         See docs/scheduler/ci.md.
       '';
 in
diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index aebc5449..92dd0699 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -175,14 +175,15 @@ in
         failure on whatever reads it.
 
         With {option}`services.hyperhive.deploy.forgejo.actionsFromSelf`
-        set, an `actions/checkout` mirror is appended to this list.
+        enabled (the default), an `actions/checkout` mirror is appended to
+        this list.
       '';
     };
 
     actionsFromSelf = lib.mkOption {
       type = lib.types.bool;
-      default = false;
-      example = true;
+      default = true;
+      example = false;
       description = ''
         Resolve a workflow's `uses: <org>/<action>@vN` against this forge
         instead of `data.forgejo.org`, and add an `actions/checkout`
@@ -191,7 +192,8 @@ in
         checkout then needs no external DNS; only the mirror's re-sync
         does.
 
-        Any other action a workflow names has to be mirrored here too.
+        Any other action a workflow names has to be mirrored here too. Set to
+        `false` to resolve actions from `data.forgejo.org` and seed no mirror.
       '';
     };
 
diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index 1e65171f..aeeb5723 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -110,6 +110,7 @@ let
     deploy.swarm-controller.enable = true;
     deploy.forgejo.enable = true;
     deploy.forgejo.mirrors = [ aMirror ];
+    deploy.forgejo.actionsFromSelf = false;
     c0re.orgAvatarPng = "/etc/marker-avatar.png";
   };
   mirrorsNoController = hive {