diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index 68415294..54d5b367 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -1667,7 +1667,6 @@ let
           "selfcheck.canary"
         ]
         && !(warned bare "allowedDomains")
-        && old.systemd.services.hive-c0re.environment.HIVE_SQUID_USERS_FILE == "/var/lib/legacy-squid/users"
         && old.services.squid.configText == new.services.squid.configText
         && lib.hasInfix "legacy-c.example" old.services.squid.configText
         && !(lib.hasInfix "legacy-c.example" bare.services.squid.configText);
@@ -1675,14 +1674,18 @@ let
     {
       # The default render, pinned so moving the options changes none of it:
       # the listen address squid binds and hive-c0re hands out, and the users
-      # file hive-c0re writes.
+      # file hive-c0re writes, on a hive holding a store identity.
       name = "squid's default listen address and users file reach squid.conf and hive-c0re unchanged";
       ok =
         let
-          e = bare.systemd.services.hive-c0re.environment;
-          conf = bare.services.squid.configText;
+          withIdentity = hiveWithController {
+            deploy.bao.enable = true;
+            deploy.authelia.enable = true;
+          };
+          e = withIdentity.systemd.services.hive-c0re.environment;
+          conf = withIdentity.services.squid.configText;
         in
-        e.HIVE_SQUID_PROXY == "${bare.services.hyperhive.network.bridgeIp}:3128"
+        e.HIVE_SQUID_PROXY == "${withIdentity.services.hyperhive.network.bridgeIp}:3128"
         && e.HIVE_SQUID_USERS_FILE == "/var/lib/hive-squid/users"
         && lib.hasInfix "http_port ${e.HIVE_SQUID_PROXY}" conf
         && lib.hasInfix "basic_ncsa_auth /var/lib/hive-squid/users" conf
diff --git a/nix/module-eval/hive-otel.nix b/nix/module-eval/hive-otel.nix
index 1b4d8e69..d420f730 100644
--- a/nix/module-eval/hive-otel.nix
+++ b/nix/module-eval/hive-otel.nix
@@ -49,7 +49,7 @@ let
     deploy.authelia.enable = true;
     # The seed `allowedFile` starts as; the canary is listed too, to show it
     # is not written twice.
-    squid.allowedDomains = [
+    deploy.hive-controller.squid.allowedDomains = [
       "github.com"
       "cache.nixos.org"
     ];
@@ -715,7 +715,7 @@ let
           hosts = lib.splitString "," e.HIVE_EGRESS_NO_PROXY;
         in
         e.HIVE_SQUID_PROXY == "${s.network.bridgeIp}:3128"
-        && e.HIVE_SQUID_PROXY == s.squid.listen
+        && e.HIVE_SQUID_PROXY == s.deploy.hive-controller.squid.listen
         && lib.all (h: lib.elem h hosts) (
           [
             s.network.bridgeIp
@@ -759,7 +759,7 @@ let
         let
           s = hiveOtelAllLocal.services.hyperhive;
         in
-        lib.elem "http_port ${s.squid.listen}" (
+        lib.elem "http_port ${s.deploy.hive-controller.squid.listen}" (
           lib.splitString "\n" hiveOtelAllLocal.services.squid.configText
         );
     }