diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 07cbd697..da924288 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -446,11 +446,15 @@ in
                 # path. Re-applied every boot in case a prior run left
                 # a tighter mode behind. Key stays 0600 below.
                 chmod 0755 ${tlsDir}
-                # Generate the cert when it's missing OR fails an
-                # openssl parse — catches truncated / corrupt leftovers
-                # from a previous interrupted run. The whole oneshot is
-                # safe to re-run; a healthy cert is left alone.
-                if [ ! -s ${tlsCert} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then
+                # Generate the cert when EITHER the cert or key is
+                # missing/empty, OR the cert fails an openssl parse —
+                # catches truncated / corrupt leftovers from a previous
+                # interrupted run AND the "cert clean but key absent"
+                # edge case (argus 🟡 on the first revision) which
+                # otherwise tripped `chmod 0600 ${tlsKey}` below with
+                # ENOENT under `set -eu`. The whole oneshot is safe to
+                # re-run; a healthy cert+key pair is left alone.
+                if [ ! -s ${tlsCert} ] || [ ! -s ${tlsKey} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then
                   echo "generating fresh self-signed cert at ${tlsCert}"
                   openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \
                     -keyout ${tlsKey} \