diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index b137b340..039aaf0a 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -1086,6 +1086,10 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-forge-oidc-secret";
+        # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec`
+        # is 90s, so without this systemd kills the unit at 90 — before it
+        # can emit the message naming the file it was waiting for.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''
@@ -1139,6 +1143,10 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-forge-swarm-controller-token";
+        # Longer than the 120s bounded wait below. `DefaultTimeoutStartSec`
+        # is 90s, so without this systemd kills the unit at 90 — before it
+        # can emit the message naming the file it was waiting for.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''
diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix
index e6fbe717..c3d6034b 100644
--- a/nix/host-modules/hive-matrix.nix
+++ b/nix/host-modules/hive-matrix.nix
@@ -710,6 +710,13 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         SyslogIdentifier = "hive-matrix-oidc-secret";
+        # Longer than the 120s bounded wait below, and that is the whole
+        # point: `DefaultTimeoutStartSec` is 90s, so without this systemd
+        # kills the unit at 90 — before it can emit the message naming the
+        # file it was waiting for. The failure then reads as a timeout with
+        # no cause rather than "authelia has not minted <path>", which is
+        # the one line that makes a fresh-hive SSO stall diagnosable.
+        TimeoutStartSec = "180s";
       };
       path = [ pkgs.coreutils ];
       script = ''