diff --git a/docs/integrations/forge.md b/docs/integrations/forge.md
index d249f914..546bc764 100644
--- a/docs/integrations/forge.md
+++ b/docs/integrations/forge.md
@@ -3,9 +3,10 @@
 Private Forgejo instance running in a nixos-container, used as the
 swarm's persistent code-collaboration surface (issues, PRs, reviews,
 attachments). Configured via `services.hyperhive.swarm.forge.*` (what the
-forge IS to every hive — its package, names, ports, URLs) plus
+forge IS to every hive — names, ports, URLs) plus
 `services.hyperhive.deploy.forgejo.*` (what the host running it decides —
-how it's served, what it mirrors, where its host-local secrets sit).
+which build it runs, how it's served, what it mirrors, where its
+host-local secrets sit).
 Container
 shape, ROOT_URL / sub-domain routing, and operator-vs-in-cluster URL
 handling live in [`docs/networking/gateway.md`](../networking/gateway.md); this file owns the
diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix
index 4c94d1ae..0d491143 100644
--- a/nix/host-modules/deploy.nix
+++ b/nix/host-modules/deploy.nix
@@ -196,9 +196,10 @@ in
     )
 
     # The rest of the forge split. What stays under `swarm.forge` is what the
-    # forge IS from any hive's point of view — its package, the names and ports
-    # it answers on, the URLs it advertises, the client id it is registered
-    # under; these five are what the host running it decides. `sso` splits
+    # forge IS from any hive's point of view — the names and ports it answers
+    # on, the URLs it advertises, the client id it is registered under; these
+    # five are what the host running it decides. Its package moved as well,
+    # further down with the other `*.package` moves. `sso` splits
     # because its two halves are different facts: the client id must match the
     # entry in authelia's register, the secret is a path on this machine.
     #
@@ -394,6 +395,12 @@ in
       [ "services" "hyperhive" "swarm" "controller" "swarmctlPackage" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "swarmctlPackage" ]
     )
+    # ⚠️ `deploy.forgejo`, not `deploy.forge` — the deploy-side name differs
+    # from the swarm-side one here, as it does for the controller and the UI.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "package" ]
+      [ "services" "hyperhive" "deploy" "forgejo" "package" ]
+    )
   ];
 
   # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the
diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index a171553f..3562fbd5 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -232,21 +232,6 @@ in
       '';
     };
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.forgejo;
-      defaultText = lib.literalExpression "pkgs.forgejo";
-      description = ''
-        Forgejo package to run inside the container. Defaults to
-        `pkgs.forgejo` (the latest release line) rather than the
-        nixpkgs-module default of `pkgs.forgejo-lts`, because LTS
-        lags far behind on schema and the DB easily ends up "newer
-        than the binary" if the operator ever ran a non-LTS forgejo
-        against the same state dir. Override to `pkgs.forgejo-lts`
-        if you actively want the slower release train.
-      '';
-    };
-
     rootUrl = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -294,13 +279,28 @@ in
     };
   };
 
-  # What stays above is what the forge IS from any hive's point of view: its
-  # package, the names and ports it answers on, the URLs it advertises, and
-  # the client id it is registered under. What lives here is what the host
-  # running it decides — how it is served, what it mirrors, and where its
-  # host-local secrets sit. Same rule as ./swarm-victorialogs.nix, and the
-  # renames are in ./deploy.nix with the rest.
+  # What stays above is what the forge IS from any hive's point of view: the
+  # names and ports it answers on, the URLs it advertises, and the client id
+  # it is registered under. What lives here is what the host running it
+  # decides — which build it runs, how it is served, what it mirrors, and
+  # where its host-local secrets sit. Same rule as ./swarm-victorialogs.nix,
+  # and the renames are in ./deploy.nix with the rest.
   options.services.hyperhive.deploy.forgejo = {
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.forgejo;
+      defaultText = lib.literalExpression "pkgs.forgejo";
+      description = ''
+        Forgejo package to run inside the container. Defaults to
+        `pkgs.forgejo` (the latest release line) rather than the
+        nixpkgs-module default of `pkgs.forgejo-lts`, because LTS
+        lags far behind on schema and the DB easily ends up "newer
+        than the binary" if the operator ever ran a non-LTS forgejo
+        against the same state dir. Override to `pkgs.forgejo-lts`
+        if you actively want the slower release train.
+      '';
+    };
+
     behindGateway = lib.mkOption {
       type = lib.types.bool;
       default = config.services.hyperhive.enable;
@@ -675,7 +675,7 @@ in
           # the nix store — no separate hive-forge container rebuild needed,
           # and no persistent-state directory involved.
           staticRootWithTheme = pkgs.runCommand "forgejo-static-with-theme" { } ''
-            cp -r --no-preserve=mode,ownership ${cfg.package.data}/. $out/
+            cp -r --no-preserve=mode,ownership ${deployCfg.forgejo.package.data}/. $out/
             mkdir -p $out/public/assets/css
             cp ${./theme-catppuccin-vibec0re.css} \
                $out/public/assets/css/theme-catppuccin-vibec0re.css
@@ -747,7 +747,7 @@ in
 
           services.forgejo = {
             enable = true;
-            package = cfg.package;
+            package = deployCfg.forgejo.package;
             database.type = "sqlite3";
             lfs.enable = true;
             settings = {
@@ -1036,7 +1036,7 @@ in
               FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
             };
             path = [
-              cfg.package
+              deployCfg.forgejo.package
               pkgs.coreutils
               pkgs.gnugrep
             ];
@@ -1126,7 +1126,7 @@ in
               FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
             };
             path = [
-              cfg.package
+              deployCfg.forgejo.package
               pkgs.coreutils
               pkgs.gnugrep
             ];
diff --git a/nix/module-eval.nix b/nix/module-eval.nix
index 8e2e3ad7..53f2d2fc 100644
--- a/nix/module-eval.nix
+++ b/nix/module-eval.nix
@@ -72,11 +72,12 @@ let
     swarm.wireguard.privateKeyFile = "/etc/wireguard/hive.key";
   };
 
-  # Same shape for the forge, which SPLIT rather than moving whole: the five
+  # Same shape for the forge, which SPLIT rather than moving whole: the six
   # host-side options are set here through their pre-rename paths while the
-  # rest of `swarm.forge` stays put. All five are defined so that dropping any
+  # rest of `swarm.forge` stays put. All six are defined so that dropping any
   # single shim entry fails the eval, not just the two the assertion reads.
   forgeOldPath = hive {
+    swarm.forge.package = pkgs.emptyDirectory;
     swarm.forge.behindGateway = true;
     swarm.forge.openFirewall = true;
     swarm.forge.hostSwarmControllerTokenFile = "/etc/forge/sc.token";