diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index 16909551..6863ce03 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -807,34 +807,18 @@ in
               # forge.darkest.space, etc.) were failing every sync
               # attempt without this.
               migrations.ALLOWED_DOMAINS = "*";
-              # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list: a
-              # STRICT whitelist whose `external` builtin allows public unicast
-              # IPs and denies private/loopback. `external` STAYS so user-repo
-              # webhooks to github/slack keep working; the hyperhive hosts are
-              # added on top, because their webhooks target a private (RFC-1918)
-              # gateway IP `external` alone denies — naming the two hosts is
-              # tighter than the broad `private` builtin.
+              # Forgejo's webhook SSRF allow-list, a strict whitelist.
+              # `external` (public unicast only) stays, or user-repo webhooks to
+              # github/slack break; both hyperhive hosts are added because their
+              # webhooks target a private gateway IP `external` denies. The
+              # swarm's host was the missing one, and every swarm-controller
+              # delivery was refused for it.
               #
-              # TWO hosts, not one. The hive's carries the config-PR + knowledge
-              # hooks; the swarm's carries swarm-controller's, and leaving it
-              # off denied every one of those:
-              #   deny '<swarm host>(10.42.0.1:443)' — webhook can only call
-              #   allowed HTTP servers
-              #
-              # Read from `swarm.ui.domain` because that is the option
-              # `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
-              # from. One value, two readers — an allow-list entry and the
-              # target it must match are two spellings of one address
-              # otherwise, and the failure is a delivery refused for a host
-              # nobody typed wrong.
-              #
-              # Not gated on `deploy.swarm-ui.enable`, even though that is what
-              # makes the controller register the hooks: in a spread deployment
-              # the forge and the UI are different hosts, so that per-host flag
-              # is false exactly where this entry is needed.
-              #
-              # `unique` because an all-local swarm legitimately serves both
-              # from one name.
+              # Not gated on `deploy.swarm-ui.enable`: in a spread deployment the
+              # forge and the swarm host are different machines, so that
+              # per-host flag is false exactly where this entry is needed.
+              # `swarm.ui.domain` is the option the controller builds its public
+              # URL from; it is slated to collapse into `swarm.domain`.
               webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
                 lib.unique (
                   [