diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index beb1a826..16909551 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -9,13 +9,6 @@ let
   gatewayCfg = config.services.hyperhive.gateway;
   hyperhiveDomain = config.services.hyperhive.domain;
   swarmDomain = config.services.hyperhive.swarm.domain;
-  # The host the swarm-controller's webhooks actually target. NOT
-  # `swarm.domain`: `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
-  # from `swarm.ui.domain`, which merely *defaults* to the swarm domain and is
-  # documented as overridable. Reading the other one would be right until
-  # someone takes that option up, and then wrong in a way whose only symptom is
-  # a refused delivery.
-  swarmUiDomain = config.services.hyperhive.swarm.ui.domain;
   tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
   networkCfg = config.services.hyperhive.network;
 
@@ -828,9 +821,12 @@ in
               #   deny '<swarm host>(10.42.0.1:443)' — webhook can only call
               #   allowed HTTP servers
               #
-              # ⚠️ `swarm.ui.domain`, NOT `swarm.domain`: swarm-controller.nix
-              # builds its `SWARM_CONTROLLER_PUBLIC_URL` from the former, which
-              # only *defaults* to the latter and is documented as overridable.
+              # Read from `swarm.ui.domain` because that is the option
+              # `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
+              # from. One value, two readers — an allow-list entry and the
+              # target it must match are two spellings of one address
+              # otherwise, and the failure is a delivery refused for a host
+              # nobody typed wrong.
               #
               # Not gated on `deploy.swarm-ui.enable`, even though that is what
               # makes the controller register the hooks: in a spread deployment
@@ -845,7 +841,7 @@ in
                     "external"
                     hyperhiveDomain
                   ]
-                  ++ lib.optional (swarmDomain != null) swarmUiDomain
+                  ++ lib.optional (swarmDomain != null) config.services.hyperhive.swarm.ui.domain
                 )
               );
               log.LEVEL = "Warn";