diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index a2ed4e61..96ddebdb 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -410,11 +410,14 @@ in
           # affect traffic destined for the bridge IP itself.
           networking.nameservers = [ networkCfg.bridgeIp ];
           # With privateNetwork=true + hostBridge the container's veth
-          # is bridge-attached. Enable DHCP so the container gets an IP
-          # from dnsmasq on the bridge (hive-gateway serves the bridge
-          # subnet). Matches how normal hive agent containers acquire
-          # their addresses.
-          networking.useDHCP = true;
+          # is bridge-attached. Enable DHCP on eth0 so the container gets
+          # an IP from dnsmasq on the bridge (hive-gateway serves the
+          # bridge subnet). Per-interface rather than global: nixos-containers
+          # sets networking.useDHCP = false for all containers (to silence
+          # the deprecated global DHCP warning), so setting useDHCP = true
+          # globally would conflict. eth0 is the inner veth name assigned
+          # by systemd-nspawn when hostBridge is used.
+          networking.interfaces.eth0.useDHCP = true;
 
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.