diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 0f9ee5c8..aae957bb 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -982,9 +982,20 @@ in
       # findutils already in the default unit PATH. Without `nixos-container`
       # on PATH every container op fails ENOENT, which `build_all` silently
       # swallows into an empty list ("no managed containers").
+      #
+      # `nix` itself shells out by bare name too: `git` whenever it has to
+      # fetch/re-resolve a git-source flake input (an agent.nix with a
+      # `git+https://…` input, or a stale flake.lock whose node URL no longer
+      # matches the flake's declared input → nix re-resolves at eval), and
+      # `ssh` to dispatch to remote builders (`nix.buildMachines` /
+      # `ssh-ng://`). Without these on PATH `nixos-container update` dies with
+      # `executing "git": No such file or directory` / `Could not find
+      # executable 'ssh'` — the agent build fails before it starts.
       path = [
         pkgs.nixos-container
         pkgs.nix # nix, nix-env, nix-instantiate — create + update
+        pkgs.gitMinimal # git — nix fetches/re-resolves git-source flake inputs
+        pkgs.openssh # ssh — nix dispatches builds to remote builders
         pkgs.util-linux # umount (nsenter is hardcoded in the script)
         pkgs.e2fsprogs # chattr
         pkgs.btrfs-progs # btrfs subvolume create/delete — Ensure/DeleteAgentSubvolume