diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md
index 45b2c39c..19cd15eb 100644
--- a/docs/swarm/ca.md
+++ b/docs/swarm/ca.md
@@ -24,7 +24,7 @@ the root, so setting the swarm CA up is an operator action rather than
 something a host assumes. Turn it on for an all-on-one-host deployment
 and the hierarchy costs no configuration.
 
-It defaults from `services.hyperhive.enableAllLocalDefaults`, the single
+It defaults from `services.hyperhive.deploy.singleHostSwarm`, the single
 switch that says "this box is the whole deployment".
 
 **A hive given neither artifact keeps the self-signed CA it has always
diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md
index d43012f9..5f25a132 100644
--- a/docs/swarm/secrets.md
+++ b/docs/swarm/secrets.md
@@ -86,7 +86,7 @@ scraped; otherwise no secret is needed and none is placed.
 ### Minting the queue's callout nkeys
 
 `nats.autoGenerateCallout` mints both keypairs on the host before the queue
-starts. It is on by default only under `enableAllLocalDefaults` — the one
+starts. It is on by default only under `singleHostSwarm` — the one
 topology where the queue, its responder and the operator are the same person. On
 every other topology, mint them yourself:
 
diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index dd72348e..c2a540a0 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -5,12 +5,12 @@ matrix homeserver, the SSO provider, the CA. Two options say where the
 optional ones live, and everything else derives:
 
 ```nix
-services.hyperhive.enableAllLocalDefaults = true;   # everything on this box
+services.hyperhive.deploy.singleHostSwarm = true;   # everything on this box
 # or, for a dedicated services host with hives elsewhere:
 services.hyperhive.deploy.allSwarmServices = true;
 ```
 
-`enableAllLocalDefaults` is the all-on-one-box switch: it defaults both
+`singleHostSwarm` is the all-on-one-box switch: it defaults both
 `deploy.allSwarmServices` (the shared services run here) and
 `swarm.ca.autoConfigure` (the swarm CA is generated here). Each derived
 toggle can still be set on its own, so "all local except X" needs no
@@ -33,7 +33,7 @@ Those two options are what makes the difference between deployments, so
 the shapes worth naming are the ones they produce:
 
 - **All-local.** Everything on one machine:
-  `enableAllLocalDefaults = true`. Setup is automatic apart from
+  `singleHostSwarm = true`. Setup is automatic apart from
   choosing a domain and creating the first user.
 - **Services on the swarm controller host.**
   `deploy.allSwarmServices = true` there; the required services
diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index 3d880c69..d7689dfd 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -119,6 +119,16 @@ in
       [ "services" "hyperhive" "swarm" "enableRequiredServices" ]
       [ "services" "hyperhive" "deploy" "allSwarmServices" ]
     )
+
+    # The mode above that one. It sat at the TOP of `services.hyperhive`,
+    # which is the same defect one tier up: that namespace is everything
+    # about hyperhive, not the settings of a single hive. The new name says
+    # what the mode asserts — the whole swarm runs on this host — instead of
+    # naming its mechanism.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "enableAllLocalDefaults" ]
+      [ "services" "hyperhive" "deploy" "singleHostSwarm" ]
+    )
   ];
 
   # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the
diff --git a/nix/host-modules/hive-gateway/options.nix b/nix/host-modules/hive-gateway/options.nix
index f0199342..010c96b5 100644
--- a/nix/host-modules/hive-gateway/options.nix
+++ b/nix/host-modules/hive-gateway/options.nix
@@ -92,7 +92,7 @@ in
         DNS shouldn't have a stale `/etc/hosts` entry sticking
         around. Requires `services.hyperhive.domain` to be set.
 
-        `services.hyperhive.enableAllLocalDefaults` turns this on as
+        `services.hyperhive.deploy.singleHostSwarm` turns this on as
         part of saying "this box is the whole deployment": that mode
         means there is no real DNS for these names and the operator is
         browsing them from the host itself. Set it here explicitly to
diff --git a/nix/host-modules/hyperhive.nix b/nix/host-modules/hyperhive.nix
index 4cec58ce..b6d177d2 100644
--- a/nix/host-modules/hyperhive.nix
+++ b/nix/host-modules/hyperhive.nix
@@ -170,7 +170,7 @@ in
     '';
   };
 
-  # `enableAllLocalDefaults` is declared in ./local-defaults.nix, with
+  # `singleHostSwarm` is declared in ./local-defaults.nix, with
   # the values it asserts. It is a deployment mode rather than a setting
   # this module's options read, so it lives with its consequences.
 
diff --git a/nix/host-modules/local-defaults.nix b/nix/host-modules/local-defaults.nix
index f025aff5..528f86de 100644
--- a/nix/host-modules/local-defaults.nix
+++ b/nix/host-modules/local-defaults.nix
@@ -1,6 +1,6 @@
 # The all-local deployment mode.
 #
-# `enableAllLocalDefaults` is a *mode*, not a default other options read:
+# `singleHostSwarm` is a *mode*, not a default other options read:
 # it says "this box is the whole deployment" and then asserts the values
 # that follow from that. mara, on the issue: it is "more of a deployment
 # mode via settings set, less a default setting".
@@ -23,7 +23,7 @@ let
   cfg = config.services.hyperhive;
 in
 {
-  options.services.hyperhive.enableAllLocalDefaults = lib.mkOption {
+  options.services.hyperhive.deploy.singleHostSwarm = lib.mkOption {
     type = lib.types.bool;
     default = false;
     example = true;
@@ -69,23 +69,23 @@ in
   # every agent at its own netns. That guard already existing is what
   # makes turning this on by default safe; without it this line would
   # break every agent's access to the forge.
-  config.services.hyperhive.gateway.localHostsEntry = lib.mkDefault cfg.enableAllLocalDefaults;
+  config.services.hyperhive.gateway.localHostsEntry = lib.mkDefault cfg.deploy.singleHostSwarm;
 
   # Out of the `swarm` attrset below, because it is a `deploy.*` option now
   # (./deploy.nix): "does THIS host run the swarm's services" is a per-host
   # decision. Written as a path rather than folded into a second
   # `config.services.hyperhive.deploy = { … }` attrset, for the same reason
   # the ⚠️ below gives about `swarm`.
-  config.services.hyperhive.deploy.allSwarmServices = lib.mkDefault cfg.enableAllLocalDefaults;
+  config.services.hyperhive.deploy.allSwarmServices = lib.mkDefault cfg.deploy.singleHostSwarm;
 
   config.services.hyperhive.swarm = {
-    ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;
+    ca.autoConfigure = lib.mkDefault cfg.deploy.singleHostSwarm;
     # The queue's auth-callout nkeys. Generating them is safe exactly
     # when one operator owns both the queue and its responder, which is
     # what this mode asserts. On any other topology the seeds have to
     # reach whoever runs the responder, and minting them here would move
     # that hand-off somewhere less visible rather than removing it.
-    nats.autoGenerateCallout = lib.mkDefault cfg.enableAllLocalDefaults;
+    nats.autoGenerateCallout = lib.mkDefault cfg.deploy.singleHostSwarm;
     # The controller's queue coordinates. Co-location is what makes these
     # derivable at all — loopback only reaches the queue when the queue is
     # here, and the minted client secret only exists on the host authelia
@@ -107,10 +107,10 @@ in
     # The *requirement* stays in `swarm-controller.nix` as an assertion:
     # needing a queue is the controller's own property in every topology,
     # and only the convenience is local.
-    controller.queue.natsUrl = lib.mkIf cfg.enableAllLocalDefaults (
+    controller.queue.natsUrl = lib.mkIf cfg.deploy.singleHostSwarm (
       lib.mkDefault "nats://127.0.0.1:${toString config.services.hyperhive.swarm.nats.port}"
     );
-    controller.queue.clientSecretFile = lib.mkIf cfg.enableAllLocalDefaults (
+    controller.queue.clientSecretFile = lib.mkIf cfg.deploy.singleHostSwarm (
       lib.mkDefault "${config.services.hyperhive.swarm.authelia.hostClientSecretDir}/swarm-controller.secret"
     );
   };
@@ -128,5 +128,5 @@ in
   # the per-host fact `swarm.*` may not carry. The ⚠️ collision note above
   # does not apply here — that one is about two definitions of `swarm`
   # itself, and this is a different top-level path.
-  config.services.hyperhive.deploy.swarm-controller.enable = lib.mkDefault cfg.enableAllLocalDefaults;
+  config.services.hyperhive.deploy.swarm-controller.enable = lib.mkDefault cfg.deploy.singleHostSwarm;
 }
diff --git a/nix/host-modules/swarm-ca.nix b/nix/host-modules/swarm-ca.nix
index d522ae57..f4d5c8cd 100644
--- a/nix/host-modules/swarm-ca.nix
+++ b/nix/host-modules/swarm-ca.nix
@@ -11,7 +11,7 @@
 # Two provisioning modes, ONE structure — what differs is who puts the
 # artifacts on disk, never what the artifacts are:
 #
-#   - autoconfigured (`services.hyperhive.enableAllLocalDefaults`, or
+#   - autoconfigured (`services.hyperhive.deploy.singleHostSwarm`, or
 #     `autoConfigure` set directly): the unit below generates the root
 #     here on first boot.
 #   - operator-provided (multi-host): the operator installs the root cert
@@ -68,7 +68,7 @@ in
         Run the whole swarm CA on this one host: generate the swarm
         root when it is missing, and issue this hive's CA under it.
 
-        `services.hyperhive.enableAllLocalDefaults` turns this on as
+        `services.hyperhive.deploy.singleHostSwarm` turns this on as
         part of the all-on-one-box mode. Set it here directly to run the
         CA on a host that is not otherwise all-local.
 
diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index fbc5a3f3..b54686ba 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -240,7 +240,7 @@ in
     };
 
     # `enable` moved to `services.hyperhive.deploy.swarm-controller.enable` — see
-    # ./deploy.nix. `services.hyperhive.enableAllLocalDefaults` still
+    # ./deploy.nix. `services.hyperhive.deploy.singleHostSwarm` still
     # asserts it, and that was never an exception to "not derived from
     # services.hyperhive.enable": that mode says "this box is the whole
     # deployment", which answers the topology question outright, where
@@ -320,7 +320,7 @@ in
           Empty means unset, which the assertion below refuses — a
           controller with no queue is not a lighter controller.
 
-          `enableAllLocalDefaults` fills this in with loopback, because
+          `singleHostSwarm` fills this in with loopback, because
           that address is only correct when the queue is on this host:
           its container shares the host netns. That derivation lives with
           the mode rather than here, so this option describes itself
@@ -354,7 +354,7 @@ in
           The controller cannot mint its own — minting happens inside
           authelia's state directory during its first boot — so away from
           that host the operator places the secret and names it here.
-          `enableAllLocalDefaults` points this at the minted file, which
+          `singleHostSwarm` points this at the minted file, which
           is exactly the case where one exists locally.
 
           Read by `LoadCredential`, so it needs to be readable by root at
diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix
index 8e98cac2..e5266cb4 100644
--- a/nix/host-modules/swarm-nats.nix
+++ b/nix/host-modules/swarm-nats.nix
@@ -297,7 +297,7 @@ in
         Leave it off wherever the queue and its clients are not the same
         operator's problem: the seeds must reach whoever runs the
         responder, and minting them here only moves that distribution
-        somewhere less visible. `enableAllLocalDefaults` turns it on.
+        somewhere less visible. `singleHostSwarm` turns it on.
       '';
     };
 
diff --git a/nix/host-modules/swarm-required-services.nix b/nix/host-modules/swarm-required-services.nix
index 46bbc5e4..bc57d663 100644
--- a/nix/host-modules/swarm-required-services.nix
+++ b/nix/host-modules/swarm-required-services.nix
@@ -37,7 +37,7 @@ in
       canonical store for the meta flake and every agent's config repo,
       so it deploys with hyperhive itself and is not optional.
 
-      `services.hyperhive.enableAllLocalDefaults` turns this on as part
+      `services.hyperhive.deploy.singleHostSwarm` turns this on as part
       of the all-on-one-box mode. Set it directly to run the swarm's
       services on a host that is not otherwise all-local — a dedicated
       services box with hives elsewhere is exactly that shape.
diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix
index 932c1540..2fd9d961 100644
--- a/nix/host-modules/swarm.nix
+++ b/nix/host-modules/swarm.nix
@@ -84,7 +84,7 @@ let
   # turned on matrix and authelia but NOT nats, so an ordinary all-local
   # hive resolved authelia's two coordinates and not the queue URL. Two of
   # three set is exactly what the assertion below rejects, so every
-  # `enableAllLocalDefaults` hive would have stopped evaluating.
+  # `singleHostSwarm` hive would have stopped evaluating.
   #
   # (The queue does derive from that switch now — ./swarm-required-services.nix
   # — so the original asymmetry is gone. The reasoning below is why the
diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 67b8b5e5..ebc36bee 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -67,7 +67,7 @@ let
       ];
     }).config;
 
-  allLocal = hive { enableAllLocalDefaults = true; };
+  allLocal = hive { deploy.singleHostSwarm = true; };
   bare = hive { };
   withCi = hive { deploy.forgejo.ci.enable = true; };