diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index b3c9a027..7ed2e398 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -43,7 +43,6 @@ let
   swarmDomain = hyperhiveCfg.swarm.domain;
   uiCfg = hyperhiveCfg.swarm.ui;
   forgeCfg = hyperhiveCfg.swarm.forge;
-  otelCfg = hyperhiveCfg.swarm.otel;
 
   # Group an account must hold to reach operator-only surfaces. Named
   # here because this module writes the rule that enforces it and
@@ -851,7 +850,13 @@ in
     # endpoint published under a name with a cert and an audience, which is a
     # different piece of work. This only stops the config asserting a
     # collection that is not happening.
-    services.hyperhive.swarm.otel.scrapeTargets = lib.mkIf otelCfg.enable {
+    # ⚠️ `swarm.otel` and not `hyperhive.otel` — two different collectors one
+    # word apart. This one is the swarm's; `hyperhive.otel` is the per-hive
+    # tier that ships telemetry upstream and never reads `scrapeTargets`.
+    # Written out in full rather than through a `let` binding so the gate and
+    # the option it gates are visibly the same path: gating the wrong one is
+    # not a build error, it is a target that is always declared or never is.
+    services.hyperhive.swarm.otel.scrapeTargets = lib.mkIf config.services.hyperhive.swarm.otel.enable {
       authelia = "127.0.0.1:${toString cfg.metricsPort}";
     };