diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index 5dc4320f..4e6937e3 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -290,42 +290,17 @@ fn reload_gateway_nginx() {
     let state = nginx_active_state();
     let success = match state.as_str() {
         "active" => {
-            // nginx master is running — SIGHUP is the zero-downtime path.
-            // `systemd-run --machine=hive-gateway --quiet --wait -- nginx
-            // -s reload` runs the signal inside the container and exits
-            // with the nginx exit code. `--` separates systemd-run flags
-            // from the command.
-            let status = std::process::Command::new("systemd-run")
-                .args([
-                    "--machine=hive-gateway",
-                    "--quiet",
-                    "--wait",
-                    "--",
-                    "nginx",
-                    "-s",
-                    "reload",
-                ])
-                .status();
-            match status {
-                Ok(s) if s.success() => {
-                    tracing::debug!("gateway nginx reload signal sent");
-                    true
-                }
-                Ok(s) => {
-                    tracing::warn!(
-                        exit_code = ?s.code(),
-                        "gateway nginx reload exited non-zero — will retry next poll tick"
-                    );
-                    false
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        error = %e,
-                        "failed to invoke systemd-run for gateway nginx reload — will retry"
-                    );
-                    false
-                }
+            // nginx master is running — ask systemd to reload the unit
+            // (SIGHUP to master, zero-downtime worker replacement).
+            // `systemctl -M hive-gateway reload nginx` lets systemd
+            // resolve the binary path; avoids the exit-203 (EXEC)
+            // failure that `systemd-run -- nginx` hit on NixOS where
+            // the limited transient-unit PATH misses /run/current-system/sw/bin/.
+            let ok = gateway_systemctl(&["reload", "nginx"]);
+            if ok {
+                tracing::debug!("gateway nginx reload signal sent");
             }
+            ok
         }
         "failed" => {
             // Unit hit start-limit (e.g. repeated nginx -t failures from
diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 851e8538..036b569b 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -421,7 +421,8 @@ in
           };
 
           # nginx reload is triggered from the HOST side by hive-c0re
-          # via `systemd-run --machine=hive-gateway nginx -s reload`
+          # via `systemctl -M hive-gateway reload nginx` — lets systemd
+          # resolve the nginx binary path, avoiding exit-203 EXEC failures.
           # after each agents.conf write. A path unit watching the
           # bind-mounted file inside the container was tried first
           # (A path unit inside the container was tried but IN_MOVED_TO from an atomic rename on the host