diff --git a/nix/host-modules/glue-bao-tls.nix b/nix/host-modules/glue-bao-tls.nix
index 4a4aff4f..18549577 100644
--- a/nix/host-modules/glue-bao-tls.nix
+++ b/nix/host-modules/glue-bao-tls.nix
@@ -43,7 +43,10 @@ let
 
   # What a reader calls itself to the store. The hive's name, because a bao
   # cert-auth role matches on the CN — this is an interface, not a label.
-  clientCn = if hyperhiveCfg.hiveName != null then hyperhiveCfg.hiveName else cfg.domain;
+  # No fallback: `hiveName` is asserted set for every hyperhive host, which is
+  # the same condition this file's `config` is gated on. A fallback here reads
+  # as a second supported spelling and there is no such thing.
+  clientCn = hyperhiveCfg.hiveName;
 
   # $1 dir  $2 basename  $3 CN  $4 SAN or ""  $5 EKU
   signLeaf = pkgs.writeShellScript "swarm-bao-sign-leaf" ''