diff --git a/flake.lock b/flake.lock
index ccbe77f4..1ce362be 100644
--- a/flake.lock
+++ b/flake.lock
@@ -17,16 +17,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778737229,
-        "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
+        "lastModified": 1779971959,
+        "narHash": "sha256-R5nauXyqyfRUFiZycFFZdkF7wl6eaUpPLst35+2nJQY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5",
+        "rev": "ec942ba042dad5ef097e2ef3a3effc034241f011",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 28656c70..a4375372 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "hyperhive — multi-Claude-Code-agent orchestration on nixos-containers";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     # Crane (replaces naersk #538). Stateless — no nixpkgs input to
     # follow; `crane.mkLib pkgs` returns the lib at whatever pkgs we
diff --git a/hive-c0re/src/flake_check.rs b/hive-c0re/src/flake_check.rs
index 71550270..75e22413 100644
--- a/hive-c0re/src/flake_check.rs
+++ b/hive-c0re/src/flake_check.rs
@@ -319,7 +319,7 @@ mod tests {
         "nodes": {
             "nixpkgs": {
                 "locked": {"rev": "aaa"},
-                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-26.05", "type": "github"}
             },
             "nixpkgs-unstable": {
                 "locked": {"rev": "bbb"},
@@ -335,15 +335,15 @@ mod tests {
         "nodes": {
             "nixpkgs": {
                 "locked": {"rev": "aaa"},
-                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-26.05", "type": "github"}
             },
             "nixpkgs_2": {
                 "locked": {"rev": "ccc"},
-                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-26.05", "type": "github"}
             },
             "nixpkgs_3": {
                 "locked": {"rev": "ddd"},
-                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-26.05", "type": "github"}
             },
             "treefmt-nix": {
                 "locked": {"rev": "eee"},
diff --git a/hive-c0re/src/meta.rs b/hive-c0re/src/meta.rs
index fe496f91..6fe93fcf 100644
--- a/hive-c0re/src/meta.rs
+++ b/hive-c0re/src/meta.rs
@@ -336,11 +336,17 @@ where
     // Pin canonical nixpkgs revisions at the meta level so every input
     // that pulls a nixpkgs sub-input can `follows = "nixpkgs"` and
     // collapse to one shared node (closes #317). hyperhive's own
-    // flake.nix picks `nixos-25.11`; we mirror that here so meta and
+    // flake.nix picks `nixos-26.05`; we mirror that here so meta and
     // hyperhive don't diverge into two stable channels by default.
     // Operator can override these at the meta layer to slide every
     // dependent agent onto a different channel in one move.
-    out.push_str("    nixpkgs.url = \"github:NixOS/nixpkgs/nixos-25.11\";\n");
+    //
+    // Keeping the URL concrete (rather than `follows = "hyperhive/nixpkgs"`)
+    // is intentional per mara on #619: a configuring agent needs the
+    // url present in the rendered meta flake so it can eval against
+    // it — `follows` requires resolving through hyperhive, which
+    // breaks standalone eval workflows the agent + manager rely on.
+    out.push_str("    nixpkgs.url = \"github:NixOS/nixpkgs/nixos-26.05\";\n");
     out.push_str("    nixpkgs-unstable.url = \"github:NixOS/nixpkgs/nixpkgs-unstable\";\n");
     let _ = writeln!(out, "    hyperhive.url = \"{hyperhive_flake}\";");
     // Collapse hyperhive's own `nixpkgs` + `nixpkgs-unstable` inputs
@@ -573,8 +579,10 @@ mod tests {
         );
         // Top-level nixpkgs inputs pinned by meta — every nested
         // nixpkgs input can follow these instead of resolving its own
-        // (closes #317).
-        assert!(out.contains("nixpkgs.url = \"github:NixOS/nixpkgs/nixos-25.11\""));
+        // (closes #317). Concrete URL (not `follows = "hyperhive/nixpkgs"`)
+        // per mara on #619 — a configuring agent needs the URL to
+        // resolve when evaluating meta standalone.
+        assert!(out.contains("nixpkgs.url = \"github:NixOS/nixpkgs/nixos-26.05\""));
         assert!(out.contains("nixpkgs-unstable.url = \"github:NixOS/nixpkgs/nixpkgs-unstable\""));
     }
 
diff --git a/nix/docs.nix b/nix/docs.nix
index bfaf5d06..b5baefc5 100644
--- a/nix/docs.nix
+++ b/nix/docs.nix
@@ -288,7 +288,7 @@ let
       echo '<h1>hyperhive — nix options reference</h1>'
       echo '<p>Auto-generated from the <a href="${forgeRoot}">hyperhive flake</a>. Two reading paths:</p>'
       echo '<h3><a href="./host.html">host options</a></h3>'
-      echo '<p>Options exposed by <code>hyperhive.nixosModules.default</code> to operator host configurations: <code>services.hive-c0re.*</code>, <code>hyperhive.domain</code>, <code>hyperhive.forge.*</code>, <code>hyperhive.matrix.*</code>.</p>'
+      echo '<p>Options exposed by <code>hyperhive.nixosModules.default</code> to operator host configurations: <code>services.hyperhive.{enable,domain,c0re,forge,matrix,gateway}.*</code>.</p>'
       echo '<h3><a href="./agent.html">agent options</a></h3>'
       echo '<p>Per-agent options declared in <code>nix/templates/harness-base.nix</code> and visible from every <code>agent.nix</code>: <code>hyperhive.model</code>, <code>hyperhive.allowedRecipients</code>, <code>hyperhive.extraMcpServers</code>, <code>hyperhive.frontend.*</code>, <code>hyperhive.forge.*</code>, <code>hyperhive.matrix.*</code>, <code>hyperhive.gui.*</code>.</p>'
       echo '<h3>Regenerate</h3>'