diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 4f840d5c..5ec1bb6c 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -1544,27 +1544,32 @@ async fn sync_agent_tmpfiles(agents: &[String]) -> Result<(String, String)> {
     }
 
     // Build tmpfiles.d content. Root dirs first, then per-agent.
+    use std::fmt::Write as _;
     let mut content =
         String::from("# managed by hive-c0re — do not edit (regenerated on spawn/destroy)\n");
     // Parent dirs — created with permissive mode so hive-c0re can make subdirs.
     // /run/hyperhive itself is also a RuntimeDirectory of hive-c0re.service; the
     // tmpfiles.d entry here ensures it exists before hive-c0re starts (boot race).
     content.push_str("d /run/hyperhive 0750 hive-core hive-core -\n");
-    content.push_str(&format!(
+    write!(
+        content,
         "d {AGENT_RUNTIME_ROOT} 0755 hive-core hive-core -\n"
-    ));
-    content.push_str(&format!("d {SOCKET_DIR_ROOT} 0755 root root -\n"));
+    )
+    .ok();
+    write!(content, "d {SOCKET_DIR_ROOT} 0755 root root -\n").ok();
     // Per-agent dirs.
     for name in agents {
-        content.push_str(&format!(
+        write!(
+            content,
             "d {AGENT_RUNTIME_ROOT}/{name} 0755 hive-core hive-core -\n"
-        ));
+        )
+        .ok();
         // 0777: agent harness (non-root uid) must bind sockets here.
         // `d` adjusts mode/owner on existing dirs; world-writable matches
         // the chmod_socket_dir(0o777) fallback so a runtime re-sync doesn't
         // break a live agent's socket dir. host_config's chown_socket_dir
         // tightens ownership afterwards when the agent uid is available.
-        content.push_str(&format!("d {SOCKET_DIR_ROOT}/{name} 0777 root root -\n"));
+        write!(content, "d {SOCKET_DIR_ROOT}/{name} 0777 root root -\n").ok();
     }
 
     // Atomic write: write to a tmp file then rename so a concurrent reader