diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 41eb3722..38aac164 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -99,10 +99,8 @@ let
   unitName = "authelia-${instance}";
   stateDir = "/var/lib/${unitName}";
 
-  caTrust = import ./lib/hive-ca-trust.nix {
-    inherit lib gatewayCfg;
-    tlsCfg = deployCfg.hive-controller.tls;
-  };
+  tlsCfg = hyperhiveCfg.tls;
+  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
   # `swarm-authelia-bridge` verifies the gateway when it introspects by name.
   # Nothing in this container trusted the swarm CA, which is a runtime file no
   # build-time option can name — so an https call out of here could only ever
diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index 6c6d37f4..81ec4374 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -20,15 +20,13 @@ let
   networkCfg = config.services.hyperhive.network;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = hyperhiveCfg.gateway;
+  tlsCfg = hyperhiveCfg.tls;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   vmCfg = hyperhiveCfg.swarm.victoriametrics;
   vlCfg = hyperhiveCfg.swarm.victorialogs;
   swarmDomain = hyperhiveCfg.swarm.domain;
 
-  caTrust = import ./lib/hive-ca-trust.nix {
-    inherit lib gatewayCfg;
-    tlsCfg = deployCfg.hive-controller.tls;
-  };
+  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
 
   # Spelled ONCE. The provisioned datasource declares it and every panel in the
   # provisioned dashboards references it; a second literal would be free to
diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix
index 01ed5c58..5856b39f 100644
--- a/nix/host-modules/swarm-otel.nix
+++ b/nix/host-modules/swarm-otel.nix
@@ -163,7 +163,7 @@ let
   # `security.pki.certificateFiles`.
   caTrust = import ./lib/hive-ca-trust.nix {
     inherit lib;
-    tlsCfg = deployCfg.hive-controller.tls;
+    tlsCfg = hyperhiveCfg.tls;
     inherit gatewayCfg;
   };