diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index 4e6937e3..5dc4320f 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -290,17 +290,42 @@ fn reload_gateway_nginx() {
     let state = nginx_active_state();
     let success = match state.as_str() {
         "active" => {
-            // nginx master is running — ask systemd to reload the unit
-            // (SIGHUP to master, zero-downtime worker replacement).
-            // `systemctl -M hive-gateway reload nginx` lets systemd
-            // resolve the binary path; avoids the exit-203 (EXEC)
-            // failure that `systemd-run -- nginx` hit on NixOS where
-            // the limited transient-unit PATH misses /run/current-system/sw/bin/.
-            let ok = gateway_systemctl(&["reload", "nginx"]);
-            if ok {
-                tracing::debug!("gateway nginx reload signal sent");
+            // nginx master is running — SIGHUP is the zero-downtime path.
+            // `systemd-run --machine=hive-gateway --quiet --wait -- nginx
+            // -s reload` runs the signal inside the container and exits
+            // with the nginx exit code. `--` separates systemd-run flags
+            // from the command.
+            let status = std::process::Command::new("systemd-run")
+                .args([
+                    "--machine=hive-gateway",
+                    "--quiet",
+                    "--wait",
+                    "--",
+                    "nginx",
+                    "-s",
+                    "reload",
+                ])
+                .status();
+            match status {
+                Ok(s) if s.success() => {
+                    tracing::debug!("gateway nginx reload signal sent");
+                    true
+                }
+                Ok(s) => {
+                    tracing::warn!(
+                        exit_code = ?s.code(),
+                        "gateway nginx reload exited non-zero — will retry next poll tick"
+                    );
+                    false
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        error = %e,
+                        "failed to invoke systemd-run for gateway nginx reload — will retry"
+                    );
+                    false
+                }
             }
-            ok
         }
         "failed" => {
             // Unit hit start-limit (e.g. repeated nginx -t failures from
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 036b569b..851e8538 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -421,8 +421,7 @@ in
           };
 
           # nginx reload is triggered from the HOST side by hive-c0re
-          # via `systemctl -M hive-gateway reload nginx` — lets systemd
-          # resolve the nginx binary path, avoiding exit-203 EXEC failures.
+          # via `systemd-run --machine=hive-gateway nginx -s reload`
           # after each agents.conf write. A path unit watching the
           # bind-mounted file inside the container was tried first
           # (A path unit inside the container was tried but IN_MOVED_TO from an atomic rename on the host