diff --git a/nix/agent-modules/forge.nix b/nix/agent-modules/forge.nix
index bea7bff8..6fe6c64b 100644
--- a/nix/agent-modules/forge.nix
+++ b/nix/agent-modules/forge.nix
@@ -124,10 +124,21 @@ in
     # by eval with both modules defining it, not assumed: a silent last-wins
     # here would drop one integration's credentials and look exactly like this
     # bug again.
+
+    # ⚠️ `hive-forge`, NOT `git-credential-hive-forge`: git prepends
+    # `git-credential-` to a helper value that is not an absolute path, so
+    # the longer spelling resolves to `git-credential-git-credential-hive-
+    # forge` and NO helper runs. `./github.nix` always had the short form.
+    #
+    # The failure is quiet, which is why it survived: git prints the
+    # unresolved name to stderr and returns no credential, but a push still
+    # works for any agent whose personal `~/.gitconfig` names the helper by
+    # ABSOLUTE path — so this is masked exactly where it would be noticed,
+    # and bites a fresh agent that has no such file.
     environment.etc."gitconfig" = lib.mkIf (config.hyperhive.forge.url != null) {
       text = ''
         [credential "${lib.removeSuffix "/" config.hyperhive.forge.url}"]
-        helper = git-credential-hive-forge
+        helper = hive-forge
         username = ${userName}
       '';
     };