diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index b5ded526..743834f9 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -60,21 +60,6 @@ in
       '';
     };
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.forgejo;
-      defaultText = lib.literalExpression "pkgs.forgejo";
-      description = ''
-        Forgejo package to run inside the container. Defaults to
-        `pkgs.forgejo` (the latest release line) rather than the
-        nixpkgs-module default of `pkgs.forgejo-lts`, because LTS
-        lags far behind on schema and the DB easily ends up "newer
-        than the binary" if the operator ever ran a non-LTS forgejo
-        against the same state dir. Override to `pkgs.forgejo-lts`
-        if you actively want the slower release train.
-      '';
-    };
-
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -102,7 +87,6 @@ in
           system.stateVersion = "25.11";
           services.forgejo = {
             enable = true;
-            package = cfg.package;
             database.type = "sqlite3";
             lfs.enable = true;
             settings = {
diff --git a/scripts/forge-create-token.sh b/scripts/forge-create-token.sh
deleted file mode 100755
index 4e46a8db..00000000
--- a/scripts/forge-create-token.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Mint a Forgejo access token for an existing user.
-#
-# Usage: forge-create-token.sh <username> [--name <label>] [--scopes <csv>]
-#
-# Defaults:
-#   --name   = local-<timestamp>
-#   --scopes = all
-#
-# Prints the token to stdout — feed it to `forge-login.sh` or paste
-# into tea / .netrc. Forgejo only shows the token once, so capture it.
-set -euo pipefail
-
-if [ $# -lt 1 ]; then
-  echo "usage: $0 <username> [--name <label>] [--scopes <csv>]" >&2
-  exit 2
-fi
-
-username="$1"; shift
-name="local-$(date +%s)"
-scopes="all"
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --name)   name="$2"; shift 2 ;;
-    --scopes) scopes="$2"; shift 2 ;;
-    *) echo "unknown arg: $1" >&2; exit 2 ;;
-  esac
-done
-
-sudo nixos-container run hive-forge -- runuser -u forgejo -- \
-  forgejo --work-path /var/lib/forgejo admin user generate-access-token \
-    --username "$username" \
-    --token-name "$name" \
-    --scopes "$scopes"
diff --git a/scripts/forge-login.sh b/scripts/forge-login.sh
deleted file mode 100755
index 9c603036..00000000
--- a/scripts/forge-login.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-# Configure the current shell user's git + tea for the hive-forge.
-#
-# Sets:
-#   - git config --global user.name / user.email
-#   - tea login (if `tea` is on PATH)
-#   - ~/.netrc entry so `git clone http://...` works without prompting
-#
-# Usage: forge-login.sh <username> [--email <addr>] [--url <forge-url>]
-#
-# Prompts for an access token on stdin (paste-and-enter). Generate
-# one first with `forge-create-token.sh <username>` or in the web UI
-# under Settings → Applications → Generate New Token.
-set -euo pipefail
-
-if [ $# -lt 1 ]; then
-  echo "usage: $0 <username> [--email <addr>] [--url <forge-url>]" >&2
-  exit 2
-fi
-
-username="$1"; shift
-email="${username}@hive.local"
-forge_url="http://localhost:3000"
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --email) email="$2"; shift 2 ;;
-    --url)   forge_url="$2"; shift 2 ;;
-    *) echo "unknown arg: $1" >&2; exit 2 ;;
-  esac
-done
-
-# Extract host:port for netrc.
-host=$(printf '%s' "$forge_url" | sed -E 's|^https?://||; s|/.*$||; s|:.*$||')
-
-read -r -s -p "forgejo access token for $username (input hidden): " token
-echo
-if [ -z "$token" ]; then
-  echo "no token entered; aborting" >&2
-  exit 1
-fi
-
-if git config --global user.name "$username" 2>/dev/null \
-  && git config --global user.email "$email" 2>/dev/null; then
-  echo "git config: $username <$email>"
-else
-  cat <<EOF
-git config: --global write failed (read-only ~/.config/git/config?
-  home-manager / nix-managed setup). add this to your home-manager:
-
-  programs.git = {
-    enable = true;
-    userName = "$username";
-    userEmail = "$email";
-  };
-EOF
-fi
-
-# netrc entry — git uses this for HTTP basic auth. 0600 because it
-# contains the plaintext token.
-netrc="$HOME/.netrc"
-touch "$netrc"
-chmod 600 "$netrc"
-if grep -q "^machine $host" "$netrc" 2>/dev/null; then
-  # Remove the old block (machine line + the two following lines).
-  sed -i.bak "/^machine $host\$/,+2d" "$netrc"
-fi
-cat >>"$netrc" <<EOF
-machine $host
-login $username
-password $token
-EOF
-echo "netrc: wrote $host entry"
-
-if command -v tea >/dev/null 2>&1; then
-  mkdir -p "$HOME/.config/tea"
-  # tea refuses to add a login with a name that already exists; drop
-  # it first so re-running this script is idempotent.
-  tea login delete forge 2>/dev/null || true
-  tea login add --name forge --url "$forge_url" --token "$token"
-  echo "tea: configured 'forge' login"
-else
-  echo "tea: not on PATH — install pkgs.tea if you want the CLI"
-fi
diff --git a/scripts/forge-migrate.sh b/scripts/forge-migrate.sh
deleted file mode 100755
index bbdc5baf..00000000
--- a/scripts/forge-migrate.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# Run pending Forgejo DB migrations + restart the daemon.
-#
-# Use after upgrading the forgejo package, or when a CLI command
-# errors with "table X has no column named Y" (schema lag).
-set -euo pipefail
-
-sudo nixos-container run hive-forge -- runuser -u forgejo -- \
-  forgejo --work-path /var/lib/forgejo migrate
-
-sudo nixos-container run hive-forge -- systemctl restart forgejo
-echo "forge: migrated + restarted"