diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix
index 4b4e964a..084937a5 100644
--- a/nix/host-modules/hive-gateway/default.nix
+++ b/nix/host-modules/hive-gateway/default.nix
@@ -283,6 +283,23 @@ in
       inherit (nginxTree) appendHttpConfig virtualHosts;
     };
 
+    # nginx now reads `/var/lib/hyperhive/gateway/agents.conf` (+
+    # gateway.htpasswd) directly off the host filesystem instead of
+    # through the old container's dedicated `/run/hive-state`
+    # bind-mount. `hive-c0re.service` declares `StateDirectory =
+    # "hyperhive"` with `StateDirectoryMode = "0750"` owned by
+    # `hive-core`, and systemd re-applies that owner/mode to the
+    # top-level `/var/lib/hyperhive` dir on every c0re start —
+    # overriding this module's own `0755 root:root` tmpfiles rule
+    # above. Without group membership, the `nginx` user can't even
+    # traverse into the directory, so nginx fails its config test and
+    # never starts (`nginx: [emerg] open() ".../agents.conf" failed
+    # (13: Permission denied)`) — the whole gateway, and every hive
+    # domain behind it, goes down. `gateway/` and `agents.conf` are
+    # already declared world-readable (0755 / 0644), so group
+    # traversal on the parent is the only thing missing.
+    systemd.services.nginx.serviceConfig.SupplementaryGroups = [ "hive-core" ];
+
     # dnsmasq is a host service alongside nginx, so it reads the host's
     # /etc/resolv.conf directly and picks up network changes as they
     # happen — no copy to keep in sync.