diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix
index 69298e4f..1cce485a 100644
--- a/nix/modules/hive-network.nix
+++ b/nix/modules/hive-network.nix
@@ -196,6 +196,18 @@ in
             resolver must be running before isolation is flipped on).
           '';
         }
+        {
+          assertion =
+            !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable;
+          message = ''
+            services.hyperhive.network.isolateContainers = true with
+            services.hyperhive.forge.enable = true requires
+            services.hyperhive.gateway.enable = true — isolated agents
+            reach the forge via `http://forge.<domain>` which nginx (in
+            the gateway container) proxies to forgejo. Without the gateway
+            there is nothing listening on port 80 to serve that hostname.
+          '';
+        }
       ];
     })