diff --git a/docs/swarm.md b/docs/swarm.md
index f6cd4bb4..df5f73fc 100644
--- a/docs/swarm.md
+++ b/docs/swarm.md
@@ -116,8 +116,8 @@ swarm's trust hierarchy.
 ## Running the swarm's shared services
 
 Some things exist once per **swarm**, not once per hive: the forge, the
-matrix homeserver, the SSO provider, the CA. Two options say where they
-live, and everything else derives:
+matrix homeserver, the SSO provider, the CA. Two options say where the
+optional ones live, and everything else derives:
 
 ```nix
 services.hyperhive.enableAllLocalDefaults = true;   # everything on this box
@@ -137,6 +137,11 @@ operator saying so rather than something inferred. With them off, a hive
 is a *client* of those services — it configures how to reach them and
 runs none of them.
 
+The forge is the exception, and not because it is per-hive: it is
+swarm-wide but **not optional**, being the canonical store for the meta
+flake and every agent's config repo, so it deploys with hyperhive itself
+and has no `enable` to derive from anything.
+
 ### SSO (authelia)
 
 One authelia per swarm, in a `swarm-authelia` container, at
diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix
index f7be1a33..1e8613bb 100644
--- a/nix/host-modules/swarm.nix
+++ b/nix/host-modules/swarm.nix
@@ -127,9 +127,10 @@
   };
 
   # "The swarm-wide services run HERE." A swarm has one forge, one
-  # matrix, one SSO — this says this host is where they live, and each
-  # of those services defaults its own enable from it rather than the
-  # operator enabling them one at a time.
+  # matrix, one SSO — this says this host is where they live. The
+  # OPTIONAL ones (matrix, authelia) default their own enable from it,
+  # rather than the operator enabling them one at a time; the forge has
+  # no enable to derive because it is not optional.
   options.services.hyperhive.swarm.enableRequiredServices = lib.mkOption {
     type = lib.types.bool;
     default = config.services.hyperhive.enableAllLocalDefaults;
@@ -137,9 +138,14 @@
     example = true;
     description = ''
       Host the swarm's shared services on this hive. The services that
-      exist once per swarm rather than once per hive — the forge, the
-      matrix homeserver, the SSO provider — default their `enable` from
-      this, so a swarm's service host is declared in one place.
+      exist once per swarm rather than once per hive and are *optional*
+      — the matrix homeserver, the SSO provider — default their
+      `enable` from this, so a swarm's service host is declared in one
+      place.
+
+      The forge is swarm-wide too but has no `enable` to derive: it is
+      the canonical store for the meta flake and every agent's config
+      repo, so it deploys with hyperhive itself and is not optional.
 
       Defaults from `services.hyperhive.enableAllLocalDefaults` (off),
       which is the all-on-one-box switch. Set it directly to run the