diff --git a/nix/host-modules/hive-priv.nix b/nix/host-modules/hive-priv.nix
index fdf5fc74..cf5ca4e2 100644
--- a/nix/host-modules/hive-priv.nix
+++ b/nix/host-modules/hive-priv.nix
@@ -104,28 +104,33 @@ in
         PrivateTmp = true;
         ProtectHome = true;
         # Harden the file system view: strict makes the entire hierarchy
-        # read-only by default; ReadWritePaths carves out exactly the paths
-        # hive-priv must write to at runtime. Each is a confirmed hive-priv
-        # write that EROFSes (os error 30) without its carve-out:
-        #   /etc/nixos-containers     — <container>.conf (bind mounts, nspawn flags)
-        #   /etc/tmpfiles.d           — sync_tmpfiles' hyperhive-agents.conf write
-        #   /run/hive-agent           — chown/chmod per-agent socket dirs
-        #   /run/systemd              — container@ drop-ins + machined state
-        #   /run/lock                 — nixos-container's create/destroy lock file
-        #   /run/hive-ci              — register_ci_runner's runner-token write
-        #                               (else token stays placeholder → runner
-        #                               crash-loops → no CI hive-wide)
-        #   /var/lib/nixos-containers — container rootfs
-        #   /var/lib/hyperhive        — agent state (forge/matrix token files)
-        #   /nix                      — nix store + profile updates on create/update
+        # read-only by default; ReadWritePaths carves out exactly the
+        # paths hive-priv must write to at runtime.
+        #
+        # Why each entry is needed:
+        #   /etc/nixos-containers  — writes <container>.conf (bind mounts,
+        #                            network isolation, nspawn flags)
+        #   /run/hive-agent        — chown/chmod per-agent socket directories
+        #   /run/systemd           — container@ unit drop-ins (resource limits)
+        #                            + machinectl / systemd-machined state
+        #   /run/lock              — `nixos-container` opens a lock file at
+        #                            /run/lock/nixos-container to serialise
+        #                            create/destroy. Under ProtectSystem=strict
+        #                            /run is read-only, so without this the very
+        #                            first `nixos-container create` (ruth, on a
+        #                            fresh host) dies with "Read-only file
+        #                            system" before any container exists.
+        #   /var/lib/nixos-containers — container rootfs written by nixos-container
+        #   /var/lib/hyperhive     — agent state files written by WriteAgentForgeToken
+        #                            / WriteAgentMatrixToken (tokens under agents/<n>/state/)
+        #   /nix                   — nix store + profile updates during
+        #                            container create/update
         ProtectSystem = "strict";
         ReadWritePaths = [
           "/etc/nixos-containers"
-          "/etc/tmpfiles.d"
           "/run/hive-agent"
           "/run/systemd"
           "/run/lock"
-          "/run/hive-ci"
           "/var/lib/nixos-containers"
           "/var/lib/hyperhive"
           "/nix"