diff --git a/hive-c0re/src/dashboard.rs b/hive-c0re/src/dashboard.rs
index 14428a37..06e47f92 100644
--- a/hive-c0re/src/dashboard.rs
+++ b/hive-c0re/src/dashboard.rs
@@ -225,9 +225,11 @@ fn render_containers(
             let port = lifecycle::agent_web_port(name);
             let claude_dir = Coordinator::agent_claude_dir(name);
             let login_badge = if claude_has_session(&claude_dir) {
-                ""
+                String::new()
             } else {
-                " <span class=\"role role-pending\">needs login</span>"
+                format!(
+                    " <a class=\"role role-pending\" href=\"http://{hostname}:{port}/\">needs login →</a>",
+                )
             };
             let _ = writeln!(
                 out,
diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix
index c633925a..17262a7c 100644
--- a/nix/templates/agent-base.nix
+++ b/nix/templates/agent-base.nix
@@ -15,6 +15,10 @@
     description = "hive-ag3nt harness";
     wantedBy = [ "multi-user.target" ];
     after = [ "network.target" ];
+    # The harness shells out to `claude` (turn loop + login flow). systemd
+    # units get a minimal PATH by default, so we have to put claude-code on
+    # it explicitly even though it's in environment.systemPackages above.
+    path = [ pkgs.claude-code ];
     serviceConfig = {
       ExecStart = "${pkgs.hyperhive}/bin/hive-ag3nt serve";
       Restart = "on-failure";
diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix
index 7920ec46..13ad1919 100644
--- a/nix/templates/manager.nix
+++ b/nix/templates/manager.nix
@@ -27,6 +27,9 @@
       HIVE_PORT = "8000";
       HIVE_LABEL = "hm1nd";
     };
+    # See note in agent-base.nix — `claude` has to be on the service PATH
+    # explicitly for the harness to shell out to it.
+    path = [ pkgs.claude-code ];
     serviceConfig = {
       ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
       Restart = "on-failure";