diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 96fd876e..61b4cd18 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -385,6 +385,20 @@ in
             sslCertificate = tlsCert;
             sslCertificateKey = tlsKey;
           };
+
+          # Public-facing scheme + port-suffix for URLs the gateway
+          # mints into responses (well-known JSON, the deprecated
+          # `<hive>/matrix/*` 301 redirect, future absolute-URL needs).
+          # When self-signed TLS is on, prefer `https://<host>` (matrix-
+          # spec compliance) — 443 elides the port. Otherwise fall back
+          # to the plain-http listen with the bare port. See
+          # `docs/gateway.md` ("Self-signed TLS"). Shared at this scope
+          # (was inlined twice, argus 🟡 on #848).
+          publicScheme = if cfg.selfSignedTls then "https" else "http";
+          publicPort = if cfg.selfSignedTls then cfg.httpsPort else cfg.port;
+          publicPortDefault = if cfg.selfSignedTls then 443 else 80;
+          publicPortSuffix =
+            if publicPort == publicPortDefault then "" else ":${toString publicPort}";
         in
         {
           system.stateVersion = "26.05";
@@ -458,16 +472,7 @@ in
                   # map.
                   lib.optionalAttrs (matrixCfg.enable && matrixCfg.gui.enable && matrixCfg.gatewayHost != null) (
                     let
-                      # Public-facing scheme + port-suffix. When self-signed TLS
-                      # is on, prefer https://<host> (matrix-spec compliance);
-                      # 443 elides the port. Otherwise fall back to the
-                      # plain-http listen with the bare port. See
-                      # `docs/gateway.md` ("Self-signed TLS").
-                      scheme = if cfg.selfSignedTls then "https" else "http";
-                      activePort = if cfg.selfSignedTls then cfg.httpsPort else cfg.port;
-                      defaultPort = if cfg.selfSignedTls then 443 else 80;
-                      portSuffix = if activePort == defaultPort then "" else ":${toString activePort}";
-                      target = "${scheme}://${matrixCfg.gatewayHost}${portSuffix}";
+                      target = "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}";
                     in
                     {
                       "/matrix/" = {
@@ -486,18 +491,14 @@ in
                     # client-bootstrap sequence.
                     lib.optionalAttrs (matrixCfg.enable && hyperhiveDomain != null) (
                       let
-                        scheme = if cfg.selfSignedTls then "https" else "http";
-                        activePort = if cfg.selfSignedTls then cfg.httpsPort else cfg.port;
-                        defaultPort = if cfg.selfSignedTls then 443 else 80;
-                        portSuffix = if activePort == defaultPort then "" else ":${toString activePort}";
                         clientBaseUrl =
                           if matrixCfg.gatewayHost != null then
-                            "${scheme}://${matrixCfg.gatewayHost}${portSuffix}"
+                            "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}"
                           else
-                            "${scheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
+                            "${publicScheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
                         serverHostPort =
                           if matrixCfg.gatewayHost != null then
-                            "${matrixCfg.gatewayHost}${portSuffix}"
+                            "${matrixCfg.gatewayHost}${publicPortSuffix}"
                           else
                             "${hyperhiveDomain}:${toString matrixCfg.httpPort}";
                       in