diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index af1ed595..32d6f4ca 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -13,23 +13,28 @@ let
   # the runner registration-token API endpoint.
   coreTokenPath = "/var/lib/hyperhive/forge-core-token";
 
-  # Oneshot run before gitea-runner-hive.service starts.
-  #
-  # The nixpkgs gitea-actions-runner module uses tokenFile as a systemd
-  # EnvironmentFile (sets TOKEN= in the environment). EnvironmentFile is
-  # loaded before any ExecStartPre, so the file MUST exist at service start —
-  # an ExecStartPre override is too late. We solve this with:
-  #   1. tmpfiles: pre-create /run/hive-ci/runner-token with TOKEN=placeholder
-  #   2. hive-ci-register.service (this script): on first boot only,
-  #      fetch the real token from forge and overwrite with TOKEN=<real>.
-  #   3. gitea-runner-hive.service: After=hive-ci-register.service
-  #
-  # On subsequent boots: .runner credentials file exists so the nixpkgs
-  # register step exits early — TOKEN value in the EnvironmentFile is
-  # irrelevant (placeholder is fine).
-  registerScript = pkgs.writeShellScript "hive-ci-register" ''
+  # Script run before the gitea-runner-hive service starts.
+  # On first boot (no .runner credentials yet) it fetches a fresh
+  # runner registration token from the forge admin API and writes it to
+  # /run/hive-ci/runner-token so gitea-actions-runner can register.
+  # On subsequent boots the .runner credentials file already exists and
+  # the runner ignores the token file entirely, so we write a dummy to
+  # satisfy the file-existence check in the NixOS module.
+  autoRegisterScript = pkgs.writeShellScript "hive-ci-autoregister" ''
     set -euo pipefail
     TOKEN_FILE=/run/hive-ci/runner-token
+    STATE_FILE=/var/lib/gitea-runner/hive/.runner
+
+    mkdir -p /run/hive-ci
+    chmod 700 /run/hive-ci
+
+    if [ -f "$STATE_FILE" ]; then
+      # Already registered — dummy token satisfies the module's path check.
+      echo "already-registered" > "$TOKEN_FILE"
+      chmod 600 "$TOKEN_FILE"
+      exit 0
+    fi
+
     CORE_TOKEN=$(cat /run/hive-ci/core-token)
     FORGE_URL="http://127.0.0.1:${toString forgeCfg.httpPort}"
 
@@ -47,9 +52,8 @@ let
       exit 1
     fi
 
-    # Write in EnvironmentFile format: TOKEN=<value>.
-    # File is already 0600 (set by tmpfiles on boot).
-    echo "TOKEN=$REG_TOKEN" > "$TOKEN_FILE"
+    echo "$REG_TOKEN" > "$TOKEN_FILE"
+    chmod 600 "$TOKEN_FILE"
   '';
 in
 {
@@ -60,11 +64,13 @@ in
   # survive restarts (gitea-actions-runner writes them to its stateDir
   # on first registration and reuses them on every subsequent start).
   #
-  # Auto-registration: on first boot a oneshot service fetches a runner
+  # Auto-registration: on first boot the container fetches a runner
   # registration token from the forge's admin API using the core token
   # hive-c0re writes to /var/lib/hyperhive/forge-core-token. No manual
   # token handling needed — `forge.ci.enable = true` is the full operator
-  # bootstrap.
+  # bootstrap. Registration flow: preStart calls the Forgejo admin API,
+  # writes the token to /run/hive-ci/runner-token, runner registers and
+  # persists credentials to stateDir — token file ignored on next boot.
   #
   # Nix builds inside the container use the shared /nix/store (standard
   # nixos-container behaviour) with sandbox-fallback = true, because
@@ -78,10 +84,7 @@ in
       example = true;
       description = ''
         Run a Forgejo Actions runner in a `hive-ci` nixos-container.
-        Grouped under `services.hyperhive.forge` because the runner is
-        tightly coupled to the forge instance it registers against.
-        Disabled by default; `services.hyperhive.forge.enable = true` is
-        a prerequisite (enforced by assertion).
+        Disabled by default; requires `services.hyperhive.forge.enable = true`.
 
         On first start the container auto-registers against hive-forge using
         hive-c0re's admin token — no manual token provisioning needed.
@@ -153,7 +156,7 @@ in
       privateNetwork = false;
 
       bindMounts = {
-        # Core token — used by hive-ci-register.service on first boot.
+        # Core token — used by the auto-register script on first boot.
         # Read-only: the container only reads it, never modifies it.
         "/run/hive-ci/core-token" = {
           hostPath = coreTokenPath;
@@ -182,9 +185,9 @@ in
             enable = true;
             name = cfg.name;
             url = "http://127.0.0.1:${toString forgeCfg.httpPort}";
-            # EnvironmentFile providing TOKEN= for the nixpkgs register step.
-            # Pre-created by tmpfiles (placeholder); overwritten with the real
-            # token by hive-ci-register.service on first boot only.
+            # Token file is written by the ExecStartPre script below.
+            # On first boot: real registration token fetched from forge API.
+            # On subsequent boots: dummy value (runner uses .runner creds).
             tokenFile = "/run/hive-ci/runner-token";
             labels = cfg.labels;
             settings = {
@@ -194,47 +197,17 @@ in
             };
           };
 
-          # Pre-create the EnvironmentFile so gitea-runner-hive.service can
-          # always load it. The nixpkgs module sets EnvironmentFile=tokenFile
-          # which systemd loads before any ExecStartPre — the file must exist
-          # at service-start time. On first boot hive-ci-register.service
-          # overwrites this placeholder with the real token before the runner
-          # starts. On subsequent boots the placeholder is harmless because
-          # the nixpkgs register step exits early when .runner already exists.
-          #
-          # Note: `f` doesn't create parent directories, but /run/hive-ci/
-          # is guaranteed to exist by the time container systemd starts:
-          # nspawn creates mount-point directories for all bindMounts before
-          # launching the container's init. So the dir is there when
-          # systemd-tmpfiles-setup.service runs.
-          systemd.tmpfiles.rules = [
-            "f /run/hive-ci/runner-token 0600 root root - TOKEN=placeholder"
+          # Prepend auto-register script before the runner service starts.
+          # `+` prefix runs with elevated privileges so it can read the
+          # bind-mounted core-token (owned by root on the host).
+          systemd.services."gitea-runner-hive".serviceConfig.ExecStartPre = lib.mkBefore [
+            "+${autoRegisterScript}"
           ];
 
-          # Oneshot that fetches a runner registration token from the forge
-          # admin API and writes it to the EnvironmentFile. Runs only on
-          # first boot (ConditionPathExists gates on .runner absence) and
-          # before gitea-runner-hive.service via the After= dependency below.
-          systemd.services.hive-ci-register = {
-            description = "Register hive-ci runner against Forgejo (first boot)";
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-              ExecStart = registerScript;
-            };
-            # Only needed before .runner credentials exist.
-            unitConfig.ConditionPathExists = "!/var/lib/gitea-runner/hive/.runner";
-          };
-
-          # Runner must start after the register oneshot so the EnvironmentFile
-          # contains the real token on first boot.
-          systemd.services."gitea-runner-hive".after = [ "hive-ci-register.service" ];
-          systemd.services."gitea-runner-hive".wants = [ "hive-ci-register.service" ];
-
           # git is required by the runner's checkout step.
           # Everything else (nix, rust tools) is either part of NixOS
           # by default or pulled in hermetically by nix flake check.
-          # curl/jq in the register script use absolute store paths.
+          # curl/jq in the autoregister preStart use absolute store paths.
           environment.systemPackages = [ pkgs.git ];
         };
     };