diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix
index fec2c70d..1e2087e0 100644
--- a/nix/host-modules/hive-tls.nix
+++ b/nix/host-modules/hive-tls.nix
@@ -583,7 +583,14 @@ in
     # nothing at all, and the clients then fall back to the platform roots —
     # which is correct for a swarm fronted by a public certificate.
     systemd.services.hive-c0re.environment.HIVE_C0RE_OIDC_CA_FILE = "${cfg.stateDir}/trust-bundle.pem";
+    # ⚠️ Gated, where the hive-c0re line above is not, and the asymmetry is
+    # the point: hive-c0re runs on every hive, the controller runs on one.
+    # Defining an environment key on a unit that does not exist CREATES a
+    # unit fragment for it — inert (no `ExecStart`, empty `wantedBy`, never
+    # activated) but present on every non-controller hive with a CA. Caught
+    # in review on this PR; it evaluates and builds clean either way, which
+    # is exactly why it needed a reviewer rather than a check.
     systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_CA_FILE =
-      "${cfg.stateDir}/trust-bundle.pem";
+      lib.mkIf hyperhiveCfg.swarm.controller.enable "${cfg.stateDir}/trust-bundle.pem";
   };
 }