diff --git a/nix/module-eval/builder.nix b/nix/module-eval/builder.nix
index 76f67a18..2354e292 100644
--- a/nix/module-eval/builder.nix
+++ b/nix/module-eval/builder.nix
@@ -409,13 +409,15 @@ let
       # The hive collector's journal allow-list carries the cache's init units
       # on a hive host with the cache and no swarm collector (`atticByHand`).
       # Where the swarm collector runs too (`atticHere`) it reads the whole
-      # journal, so the units are not named twice; without the cache
-      # (`atticExternal`) they are absent. `hive-c0re.service` is the control
-      # that each list is the one the collector reads.
+      # journal, so no unit is named and the hive collector has no journald
+      # receiver; without the cache (`atticExternal`, which also runs the swarm
+      # collector) the units are absent too. `hive-c0re.service` on `atticByHand`
+      # is the control that the lookup finds the list.
       name = "the hive collector ships the cache's init units only where nothing else reads the host journal";
       ok =
         let
-          units = m: m.services.opentelemetry-collector.settings.receivers.journald.units;
+          units =
+            m: (m.services.opentelemetry-collector.settings.receivers.journald or { units = [ ]; }).units;
           initUnits = [
             "swarm-bao-attic-secret.service"
             "swarm-bao-attic-tokens.service"
@@ -426,26 +428,23 @@ let
         has atticByHand
         && hasNone atticHere
         && hasNone atticExternal
-        && lib.all (m: lib.elem "hive-c0re.service" (units m)) [
-          atticByHand
-          atticHere
-          atticExternal
-        ];
+        && lib.elem "hive-c0re.service" (units atticByHand);
     }
     {
       # The hive collector ships the container units' start output (the rootfs
       # check's lines) unless the swarm collector already reads the whole
-      # journal. `hive-c0re.service` is the control that the lookup finds the
-      # list.
+      # journal. `hive-c0re.service` on `atticByHand` is the control that the
+      # lookup finds the list.
       name = "the hive collector ships the container units' journal only where nothing else reads the host journal";
       ok =
         let
-          units = m: m.services.opentelemetry-collector.settings.receivers.journald.units;
+          units =
+            m: (m.services.opentelemetry-collector.settings.receivers.journald or { units = [ ]; }).units;
           glob = "container@*.service";
         in
         lib.elem glob (units atticByHand)
         && !(lib.elem glob (units atticHere))
-        && lib.elem "hive-c0re.service" (units atticHere);
+        && lib.elem "hive-c0re.service" (units atticByHand);
     }
     {
       # Both host units log in as the cache's principal, not the hive's, and