diff --git a/flake.nix b/flake.nix
index a4b9e0e7..c27254ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -221,6 +221,49 @@
                 --prefix PATH : ${pkgs.wireguard-tools}/bin
             '';
           };
+          # Operator CLI only — ships `hivectl` (with shell completions
+          # and the `wg` wrapper) without the daemon binaries. Suitable
+          # for `nix profile install .#hivectl` / `environment.systemPackages
+          # = [ inputs.hyperhive.packages.${system}.hivectl ]` when the
+          # operator only wants the admin CLI on their workstation and
+          # does not want `hive-c0re` or `hive-ag3nt` in PATH.
+          # Shares `cargoArtifacts` with `packages.default` so there is no
+          # double-compile cost when both are in the same `nix build`
+          # invocation.
+          hivectl = craneLib.buildPackage {
+            src = cleanSrc;
+            inherit cargoArtifacts;
+            cargoExtraArgs = "--bin hivectl";
+            pname = "hivectl";
+            version = "0.1.0";
+            meta.description = "hyperhive operator CLI";
+            doCheck = false;
+            nativeBuildInputs = nativeBuildInputs ++ [
+              pkgs.installShellFiles
+              pkgs.makeWrapper
+            ];
+            postInstall = ''
+              installShellCompletion --cmd hivectl \
+                --bash <("$out/bin/hivectl" completions bash) \
+                --zsh <("$out/bin/hivectl" completions zsh) \
+                --fish <("$out/bin/hivectl" completions fish)
+              wrapProgram "$out/bin/hivectl" \
+                --prefix PATH : ${pkgs.wireguard-tools}/bin
+            '';
+          };
+          # Forgejo CLI only — ships `hive-forge` without the rest of
+          # the workspace. Useful for operator workstations / CI
+          # environments that only need forge access. Shares
+          # `cargoArtifacts` with `packages.default`.
+          hive-forge = craneLib.buildPackage {
+            src = cleanSrc;
+            inherit cargoArtifacts;
+            cargoExtraArgs = "--bin hive-forge";
+            pname = "hive-forge";
+            version = "0.1.0";
+            meta.description = "hyperhive Forgejo CLI";
+            doCheck = false;
+          };
           # Bundled browser assets — see ./nix/frontend.nix. Output is
           # $out/{dashboard,agent}/ which the Rust binaries serve via
           # tower_http::ServeDir.