diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 19489046..13eefd3b 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1673,8 +1673,11 @@ in
     # the PAT from HIVE_GITHUB_TOKEN_FILE at invocation and auths as
     # `x-access-token` + the PAT. System /etc/gitconfig merges under the agent's
     # ~/.gitconfig (safe.directory), so this is additive.
-    environment.etc = lib.optionalAttrs config.hyperhive.github.enable {
-      "gitconfig".text = ''
+    # Nested-path binding + mkIf (matching the other `environment.etc."…"`
+    # entries above) — a whole-set `environment.etc = {…}` here would collide
+    # with them at the nix level ("attribute already defined").
+    environment.etc."gitconfig" = lib.mkIf config.hyperhive.github.enable {
+      text = ''
         [credential "https://github.com"]
         helper = hive-github
         username = x-access-token