diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 33d096f2..9fce8702 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -849,7 +849,24 @@ in
             };
             # `FORGEJO_CUSTOM` (not `GITEA_CUSTOM` — forgejo renamed it)
             # is how the CLI finds the app.ini upstream's module wrote.
-            environment.FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
+            #
+            # `SSL_CERT_FILE` for the same reason `forgejo.service` has it,
+            # and it was missing here: registering the login source makes an
+            # **outbound HTTPS call** — the CLI fetches
+            # `<issuer>/.well-known/openid-configuration` to validate the
+            # provider before writing the row. That URL is a swarm service
+            # name served under the swarm CA, which the default system store
+            # has never heard of, so without this the unit fails every single
+            # time with `x509: certificate signed by unknown authority` and no
+            # restart can help it.
+            #
+            # The trust belongs to every process that makes the call, not to
+            # the service that happens to be the obvious consumer. Same
+            # binary, same host, different unit — and only one of them had it.
+            environment = {
+              FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
+            }
+            // lib.optionalAttrs useSelfSigned { SSL_CERT_FILE = forgeCaBundle; };
             path = [
               cfg.package
               pkgs.coreutils