diff --git a/flake.nix b/flake.nix
index d32a796a..8eef657c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -149,11 +149,34 @@
 
       nixosConfigurations =
         let
+          # Values the agent modules require but that only a real
+          # deployment can know. Real containers are built from the
+          # generated meta flake, where hive-c0re renders these per
+          # agent from the host's `HIVE_FORGE_URL` (see meta.rs's
+          # `SERVICE_URL_OPTIONS`) — they never evaluate through
+          # `self.nixosConfigurations`, so nothing here can reach a
+          # running agent. These two configs exist only to typecheck
+          # the modules and to pre-build the container closure
+          # (`system.extraDependencies`, see hive-c0re/default.nix).
+          #
+          # Deliberately a `.invalid` host (RFC 2606: guaranteed not to
+          # resolve) rather than something plausible like a loopback
+          # port. If this value ever *did* escape into a runtime path,
+          # it must fail loudly at DNS instead of quietly connecting to
+          # whatever happens to be listening — which is the entire
+          # point of removing the `http://localhost:3000` default this
+          # replaces.
+          evalOnlyPlaceholders = {
+            hyperhive.forge.url = "http://forge.invalid";
+          };
           mkContainer =
             module:
             nixpkgs.lib.nixosSystem {
               system = "x86_64-linux";
-              modules = [ module ];
+              modules = [
+                module
+                evalOnlyPlaceholders
+              ];
             };
         in
         {