diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index b3820c68..d8ff1d4f 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -411,6 +411,17 @@ in
               # disallowed hosts"). Allow loopback + RFC-1918 sources
               # so an in-hive mirror of the hyperhive repo works.
               migrations.ALLOW_LOCALNETWORKS = true;
+              # Forgejo's docs say an empty `ALLOWED_DOMAINS` allows
+              # every domain, but that's not true in practice on the
+              # versions we've hit this on — the migration guard still
+              # rejects genuinely public hosts ("cannot import from
+              # disallowed hosts") unless the wildcard is set
+              # explicitly (a known upstream doc/behavior mismatch,
+              # tracked upstream in the go-gitea project). Public-domain
+              # pull/push mirrors (agents' personal repos synced to
+              # forge.darkest.space, etc.) were failing every sync
+              # attempt without this.
+              migrations.ALLOWED_DOMAINS = "*";
               # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list, and
               # it's a STRICT whitelist (only listed hosts deliver). Its
               # default is the `external` builtin: all public unicast IPs are