diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index f9ca2306..d81921a8 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -12,26 +12,18 @@ let
   # ROOT_URL forgejo advertises in clone links + outbound URLs. When
   # served behind the gateway, `cfg.domain` doubles as both the
   # forgejo `DOMAIN` setting AND the gateway vhost server-name, so
-  # ROOT_URL just uses it directly (dropping the port suffix on the
-  # canonical port for the scheme — 80 for http, 443 for https). The
-  # scheme + port follow what the gateway actually serves: `https` when
-  # the gateway terminates TLS (a self-signed cert or an external
-  # `tls.certDir`), `http` otherwise — advertising `http://` for a TLS
-  # gateway produces broken clone links + mixed-content redirects.
-  # When direct (gateway off or `behindGateway = false`), keep the
-  # host:httpPort shape so direct browser access still produces correct
-  # links. Operators can still override via `cfg.rootUrl` for bespoke
-  # shapes.
-  gatewayTls = gatewayCfg.selfSignedTls || gatewayCfg.tls.certDir != null;
+  # ROOT_URL just uses it directly (drops the port suffix when the
+  # gateway is on the canonical port 80). When direct (gateway off
+  # or `behindGateway = false`), keep the host:port shape so direct
+  # browser access on `:httpPort` still produces correct links.
+  # Operators can override via `cfg.rootUrl` for TLS / non-default
+  # gateway ports / bespoke shapes.
   defaultRootUrl =
     if cfg.behindGateway then
       let
-        scheme = if gatewayTls then "https" else "http";
-        port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
-        canonicalPort = if gatewayTls then 443 else 80;
-        portSuffix = if port == canonicalPort then "" else ":${toString port}";
+        portSuffix = if gatewayCfg.port == 80 then "" else ":${toString gatewayCfg.port}";
       in
-      "${scheme}://${cfg.domain}${portSuffix}/"
+      "http://${cfg.domain}${portSuffix}/"
     else
       "http://${cfg.domain}:${toString cfg.httpPort}/";
   effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
@@ -155,19 +147,16 @@ in
       description = ''
         Override the auto-derived forgejo `ROOT_URL`. When `null`
         (default), `ROOT_URL` is derived from `cfg.domain` + gateway
-        state, including the scheme:
+        state:
 
-        - `behindGateway = true` → `https://''${cfg.domain}/` when the
-          gateway terminates TLS (`gateway.selfSignedTls = true` or
-          `gateway.tls.certDir` set), otherwise `http://''${cfg.domain}/`.
-          A non-canonical gateway port (`gateway.port` for http,
-          `gateway.httpsPort` for https) is appended as `:<port>`.
+        - `behindGateway = true` → `http://''${cfg.domain}/` (uses
+          `services.hyperhive.gateway.port` when non-80)
         - `behindGateway = false` → `http://''${cfg.domain}:''${cfg.httpPort}/`
 
-        The TLS scheme is derived automatically now, so you only need to
-        set this for a genuinely bespoke shape (e.g. an external reverse
-        proxy on a different host/path). Must end with `/` per forgejo's
-        `ROOT_URL` contract.
+        Set this to a fully-qualified URL when running behind TLS
+        termination (`https://...`), a non-default gateway port, or
+        a bespoke shape. Must end with `/` per forgejo's `ROOT_URL`
+        contract.
       '';
     };