diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 5ec1bb6c..5a39d5ef 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -1539,29 +1539,25 @@ fn write_bridge_dns_marker(container: &str, isolation: Option<&NetworkIsolation>
 const TMPFILES_PATH: &str = "/etc/tmpfiles.d/hyperhive-agents.conf";
 
 async fn sync_agent_tmpfiles(agents: &[String]) -> Result<(String, String)> {
+    use std::fmt::Write as _;
     for name in agents {
         validate_agent_name(name)?;
     }
 
     // Build tmpfiles.d content. Root dirs first, then per-agent.
-    use std::fmt::Write as _;
     let mut content =
         String::from("# managed by hive-c0re — do not edit (regenerated on spawn/destroy)\n");
     // Parent dirs — created with permissive mode so hive-c0re can make subdirs.
     // /run/hyperhive itself is also a RuntimeDirectory of hive-c0re.service; the
     // tmpfiles.d entry here ensures it exists before hive-c0re starts (boot race).
     content.push_str("d /run/hyperhive 0750 hive-core hive-core -\n");
-    write!(
-        content,
-        "d {AGENT_RUNTIME_ROOT} 0755 hive-core hive-core -\n"
-    )
-    .ok();
-    write!(content, "d {SOCKET_DIR_ROOT} 0755 root root -\n").ok();
+    writeln!(content, "d {AGENT_RUNTIME_ROOT} 0755 hive-core hive-core -").ok();
+    writeln!(content, "d {SOCKET_DIR_ROOT} 0755 root root -").ok();
     // Per-agent dirs.
     for name in agents {
-        write!(
+        writeln!(
             content,
-            "d {AGENT_RUNTIME_ROOT}/{name} 0755 hive-core hive-core -\n"
+            "d {AGENT_RUNTIME_ROOT}/{name} 0755 hive-core hive-core -"
         )
         .ok();
         // 0777: agent harness (non-root uid) must bind sockets here.
@@ -1569,7 +1565,7 @@ async fn sync_agent_tmpfiles(agents: &[String]) -> Result<(String, String)> {
         // the chmod_socket_dir(0o777) fallback so a runtime re-sync doesn't
         // break a live agent's socket dir. host_config's chown_socket_dir
         // tightens ownership afterwards when the agent uid is available.
-        write!(content, "d {SOCKET_DIR_ROOT}/{name} 0777 root root -\n").ok();
+        writeln!(content, "d {SOCKET_DIR_ROOT}/{name} 0777 root root -").ok();
     }
 
     // Atomic write: write to a tmp file then rename so a concurrent reader