diff --git a/nix/host-modules/hive-gateway/options.nix b/nix/host-modules/hive-gateway/options.nix
index 74bef4da..b6616656 100644
--- a/nix/host-modules/hive-gateway/options.nix
+++ b/nix/host-modules/hive-gateway/options.nix
@@ -91,6 +91,12 @@ in
         gateway shape. Off by default — operators running with real
         DNS shouldn't have a stale `/etc/hosts` entry sticking
         around. Requires `services.hyperhive.domain` to be set.
+
+        `services.hyperhive.enableAllLocalDefaults` turns this on as
+        part of saying "this box is the whole deployment": that mode
+        means there is no real DNS for these names and the operator is
+        browsing them from the host itself. Set it here explicitly to
+        override in either direction.
       '';
     };
 
diff --git a/nix/host-modules/local-defaults.nix b/nix/host-modules/local-defaults.nix
index c423672a..acda256e 100644
--- a/nix/host-modules/local-defaults.nix
+++ b/nix/host-modules/local-defaults.nix
@@ -29,11 +29,15 @@ in
     example = true;
     description = ''
       Run the whole swarm on this host. Turning this on asserts the
-      swarm-level toggles that an all-on-one-box deployment implies:
-      the swarm's shared services
+      toggles that an all-on-one-box deployment implies: the swarm's
+      shared services
       (`services.hyperhive.swarm.enableRequiredServices`), the swarm
-      CA (`services.hyperhive.swarm.ca.autoConfigure`), and the swarm
-      controller (`services.hyperhive.swarm.controller.enable`).
+      CA (`services.hyperhive.swarm.ca.autoConfigure`), the swarm
+      controller (`services.hyperhive.swarm.controller.enable`), and the
+      host's `/etc/hosts` entries for the names this hive serves
+      (`services.hyperhive.gateway.localHostsEntry`) — with no real DNS
+      for those names, the operator is browsing them from the same box
+      that answers for them.
 
       **Off by default, and that is the load-bearing part.** A swarm's
       services and its hives can live on different hosts, and a host has
@@ -52,6 +56,21 @@ in
   # own `default` (1500) and loses to any explicit definition, which is
   # exactly the precedence a deployment mode wants: it fills in for an
   # operator who hasn't spoken, and never argues with one who has.
+  # The gateway's own all-local bit. `localHostsEntry` maps every name
+  # this hive answers for to 127.0.0.1 in the HOST's /etc/hosts, which is
+  # exactly what "this box is the whole deployment" implies: there is no
+  # real DNS for these names, and the operator is browsing them from the
+  # same machine that serves them.
+  #
+  # ⚠️ It does NOT affect what containers resolve. dnsmasq sets
+  # `no-hosts = true` unconditionally (see hive-gateway/dnsmasq.nix), so
+  # agents keep getting the bridge IP from the authoritative `address=`
+  # rules rather than the host's 127.0.0.1 — an entry that would point
+  # every agent at its own netns. That guard already existing is what
+  # makes turning this on by default safe; without it this line would
+  # break every agent's access to the forge.
+  config.services.hyperhive.gateway.localHostsEntry = lib.mkDefault cfg.enableAllLocalDefaults;
+
   config.services.hyperhive.swarm = {
     enableRequiredServices = lib.mkDefault cfg.enableAllLocalDefaults;
     ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;