diff --git a/hive-c0re/src/meta.rs b/hive-c0re/src/meta.rs
index 8ea3dbe5..f4ece83b 100644
--- a/hive-c0re/src/meta.rs
+++ b/hive-c0re/src/meta.rs
@@ -703,7 +703,6 @@ const FORWARDED_VARS: &[&str] = &[
     "HIVE_FORGE_URL",
     "HIVE_FORGE_PUBLIC_URL",
     "HIVE_MATRIX_URL",
-    "HYPERHIVE_PEERS",
     "HYPERHIVE_HIVE_DOMAIN",
     "HYPERHIVE_HIVE_NAME",
     "HYPERHIVE_SWARM_NAME",
diff --git a/nix/host-modules/hive-c0re/environment.nix b/nix/host-modules/hive-c0re/environment.nix
index 852d2f23..41003e78 100644
--- a/nix/host-modules/hive-c0re/environment.nix
+++ b/nix/host-modules/hive-c0re/environment.nix
@@ -209,28 +209,3 @@ in
     in
     "${s.address}:${toString s.port}";
 }
-// lib.optionalAttrs (config.services.hyperhive.swarm.peerHives != { }) {
-  # Peer hives serialised as a JSON array of {domain, cert_fingerprint,
-  # wireguard_address?} objects. Consumed by hive-agent::identity::peers().
-  # `cert_fingerprint` is currently unconsumed (was read only by the
-  # per-hive dashboard's now-removed "peer hives" display — see
-  # docs/swarm/README.md's certFingerprint note); still emitted here
-  # since the shape is shared with `wireguard_address`, which is not
-  # dead. `cert_fingerprint` is null for CA-trusted hives;
-  # `wireguard_address` is omitted when not part of the mesh.
-  #
-  # Reads `peerHives` — `swarm.hives` minus this hive — so the "not me"
-  # filter is the one derived in ../swarm.nix rather than a fifth copy.
-  HYPERHIVE_PEERS = builtins.toJSON (
-    lib.mapAttrsToList (
-      _name: p:
-      {
-        inherit (p) domain;
-        cert_fingerprint = p.certFingerprint;
-      }
-      // lib.optionalAttrs (p.wireguardAddress != null) {
-        wireguard_address = p.wireguardAddress;
-      }
-    ) config.services.hyperhive.swarm.peerHives
-  );
-}
diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix
index 238d2a27..2d785c5f 100644
--- a/nix/host-modules/swarm.nix
+++ b/nix/host-modules/swarm.nix
@@ -10,12 +10,11 @@
 # could hold different endpoints for the same third hive and nothing
 # detected it. One entry per hive makes that unrepresentable.
 #
-# Consumed by hive-c0re's environment (HYPERHIVE_PEERS — see
-# ./hive-c0re), identity.rs, swarm-controller's own hive directory (its
-# `/api/hives`, swarm-controller.nix), and the mesh in
-# ./swarm-wireguard.nix. The mesh lives there rather than here because
-# bringing up an interface is host networking rather than swarm
-# bookkeeping, and a host that runs no hive still needs it.
+# Consumed by swarm-controller's own hive directory (its `/api/hives`,
+# swarm-controller.nix) and the mesh in ./swarm-wireguard.nix. The mesh
+# lives there rather than here because bringing up an interface is
+# host networking rather than swarm bookkeeping, and a host that runs
+# no hive still needs it.
 {
   lib,
   config,
@@ -76,8 +75,10 @@ in
               defaultText = lib.literalExpression ''"''${name}.''${services.hyperhive.swarm.domain}"'';
               example = "lab.example.com";
               description = ''
-                Public DNS domain this hive occupies — used for dashboard
-                links, peer HTTPS checks and Matrix federation discovery.
+                Public DNS domain this hive occupies — used for
+                swarm-controller's hive roster, agent identity
+                (qualified `agent@domain` labels), and Matrix federation
+                discovery.
 
                 Defaults to `<name>.<swarm.domain>`, the convention every
                 hive in a swarm follows, so a conventional directory is
@@ -86,33 +87,6 @@ in
               '';
             };
 
-            certFingerprint = lib.mkOption {
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-              example = "sha256:b1946ac92492d2347c6235b4d2611184a3f5b6cae6c19d6e3c2f0a8e7d4c9f12";
-              description = ''
-                Expected TLS certificate fingerprint for this hive's HTTPS
-                endpoint. Null = trust the CA bundle — which for a hive
-                inside the swarm CA hierarchy is the normal case, since
-                every hive under the swarm root already chains to it.
-                Set it to pin a leaf that no CA in the bundle vouches for.
-
-                Format: the literal `sha256:` followed by exactly 64
-                hex digits (case-insensitive, no colon separators) — the
-                SHA-256 digest of the DER-encoded leaf certificate.
-                Generate with `openssl x509 -noout -fingerprint -sha256`,
-                then strip the colons and prepend `sha256:`. A malformed
-                value is ignored with a warning rather than weakening
-                trust. See docs/swarm/README.md for the full recipe.
-
-                Scopes only to hive-c0re's own peer HTTPS checks — it does
-                NOT help Matrix federation, which validates against the
-                container's trust bundle. There is no per-hive CA field to
-                cover that case any more: the swarm root is the trust path
-                (see ./swarm-ca.nix).
-              '';
-            };
-
             wireguardPublicKey = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               default = null;
@@ -147,9 +121,9 @@ in
               description = ''
                 IP address (with prefix) of this hive's host on the
                 WireGuard mesh. Used as the `allowedIPs` for its
-                WireGuard config entry and injected into `HYPERHIVE_PEERS`
-                so hive-c0re can route intra-swarm traffic to the mesh
-                address rather than the public domain. Required to include
+                WireGuard config entry (`./swarm-wireguard.nix`), so
+                intra-swarm traffic can route over the mesh address
+                rather than the public domain. Required to include
                 a hive in the mesh (entries missing this field are
                 silently excluded from `wg-hive`).
               '';