diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 3435049b..eabd3d10 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -441,17 +441,13 @@ in
               ''
                 set -eu
                 mkdir -p ${tlsDir}
-                # 0755 on BOTH the cert dir and its parent so nginx
-                # (master starts as root but workers drop to the nginx
-                # user) can traverse the whole path to read the cert.
-                # The parent `/var/lib/hive-gateway` lands at 0700 by
-                # default (systemd-nspawn StateDirectory / mkdir umask
-                # depending on which service created it first), which
-                # blocks the nginx-user worker from even reaching
-                # `${tlsDir}` and surfaces as a generic "cannot load
-                # certificate" at nginx start. Re-applied every boot
-                # in case a prior run left a tighter mode behind. Key
-                # stays 0600 below.
+                # 0755 on BOTH the cert dir and its parent so the
+                # nginx user can traverse the full path. The parent
+                # `/var/lib/hive-gateway` lands at 0700 by default
+                # (systemd StateDirectory / mkdir umask depending on
+                # which service created it first), which on its own
+                # blocks traversal. Re-applied every boot in case a
+                # prior run left a tighter mode behind.
                 chmod 0755 ${builtins.dirOf tlsDir}
                 chmod 0755 ${tlsDir}
                 # Generate the cert when EITHER the cert or key is
@@ -470,7 +466,15 @@ in
                     -subj "/CN=${subjectCN}" \
                     -addext "subjectAltName=${sanLines}"
                 fi
-                chmod 0600 ${tlsKey}
+                # Key owned by root:nginx, mode 0640 so nginx-pre-start
+                # (which runs `nginx -t` as the nginx user, not root)
+                # can read it. A 0600 root:root key passes the master-
+                # process load (master starts as root) but fails the
+                # pre-start config test with `BIO_new_file() …
+                # Permission denied`, blocking the unit from starting
+                # at all. Cert is world-readable.
+                chown root:nginx ${tlsKey}
+                chmod 0640 ${tlsKey}
                 chmod 0644 ${tlsCert}
               '';
           };