diff --git a/frontend/packages/dashboard/src/logs.html b/frontend/packages/dashboard/src/logs.html
index 037e1b01..a682c241 100644
--- a/frontend/packages/dashboard/src/logs.html
+++ b/frontend/packages/dashboard/src/logs.html
@@ -15,8 +15,8 @@
   <!-- Minimal chrome: back link + sub-tab strip.
        Same pattern as flow.html — no full dashboard tabbar. Back link
        points to the H0M3 hub (served at /), not the dashboard.
-       Four sub-tabs: AGENT, INFRA, SYSTEM, AUDIT. Build log history has
-       moved to /builds.html (the build lifecycle hub). -->
+       Three sub-tabs: AGENT, SYSTEM, AUDIT. Build log history has moved
+       to /builds.html (the build lifecycle hub). -->
   <header class="page-header">
     <a class="page-back" href="/">← home</a>
     <nav class="hive-tabbar logs-tabbar" id="logs-tabbar" role="tablist">
@@ -24,10 +24,6 @@
          aria-controls="logs-pane-agent" data-tab="agent">
         <span class="logs-tab-label">AGENT</span>
       </a>
-      <a class="hive-tab" id="logs-tab-infra" href="#infra" role="tab"
-         aria-controls="logs-pane-infra" data-tab="infra">
-        <span class="logs-tab-label">INFRA</span>
-      </a>
       <a class="hive-tab" id="logs-tab-system" href="#system" role="tab"
          aria-controls="logs-pane-system" data-tab="system">
         <span class="logs-tab-label">SYSTEM</span>
@@ -61,21 +57,6 @@
       <pre id="agent-output" class="journal-output">select an agent above</pre>
     </section>
 
-    <!-- INFRA: journald viewer for infrastructure containers (hive-ci,
-         hive-forge, hive-gateway, hive-matrix). Always fetches the full
-         machine journal — no unit filter (infra containers don't run the
-         per-agent hive daemons). Backed by GET /api/journal/{name}?lines=N.
-         Deep-link: ?agent=hive-ci routes here instead of the AGENT tab. -->
-    <section class="logs-pane" id="logs-pane-infra" data-tab-pane="infra"
-             role="tabpanel" aria-labelledby="logs-tab-infra">
-      <div class="logs-toolbar">
-        <select id="infra-select" class="journal-unit"></select>
-        <button type="button" class="btn btn-restart" id="infra-refresh">↻ refresh</button>
-        <span id="infra-fetch-ts" class="meta logs-fetch-ts" hidden></span>
-      </div>
-      <pre id="infra-output" class="journal-output">select a container above</pre>
-    </section>
-
     <!-- SYSTEM: host-side service logs. Shows the hive-c0re daemon
          journal via GET /api/journal-host?unit=hive-c0re.service. -->
     <section class="logs-pane" id="logs-pane-system" data-tab-pane="system"
diff --git a/frontend/packages/dashboard/src/logs.js b/frontend/packages/dashboard/src/logs.js
index 4200ab7a..c6807244 100644
--- a/frontend/packages/dashboard/src/logs.js
+++ b/frontend/packages/dashboard/src/logs.js
@@ -1,18 +1,16 @@
-// /logs.html entry point: log viewer with four sub-tabs (AGENT, INFRA,
-// SYSTEM, AUDIT). Build log history has moved to /builds.html.
+// /logs.html entry point: log viewer with three sub-tabs (AGENT, SYSTEM,
+// AUDIT). Build log history has moved to /builds.html.
 // AGENT  — per-container journald viewer, backed by GET /api/journal/{name}
-// INFRA  — infra-container journald viewer (hive-ci, hive-forge, …),
-//          same API but full machine journal only (no unit filter)
 // SYSTEM — host service logs, backed by GET /api/journal-host
 // AUDIT  — agent-initiated privileged-action trail, GET /api/audit-log;
 //          live-appends via the `audit_entry_added` /dashboard/stream event
 //
-// Tab routing via URL hash (#agent, #infra, #system, #audit). Default: #agent.
+// Tab routing via URL hash (#agent, #system, #audit). Default: #agent.
 //
-// URL params `?agent=name` and `?unit=svc` pre-select the agent + unit.
-// When `?agent=` names an infra container the INFRA tab is activated instead.
-// Last-fetched timestamp is shown next to the refresh button on AGENT,
-// INFRA, and SYSTEM tabs so the operator knows how stale the output is.
+// URL params `?agent=name` and `?unit=svc` pre-select the agent + unit on
+// the AGENT tab (deep-link from other pages, e.g. the per-agent ⋮ menu).
+// Last-fetched timestamp is shown next to the refresh button on AGENT +
+// SYSTEM tabs so the operator knows how stale the output is.
 
 import {
   $, el, fmtAgeSecs, openStream, initServerWarnings,
@@ -25,20 +23,14 @@ import { createTabStrip } from '@hive/shared/tabs.js';
 
   // ─── tab routing ──────────────────────────────────────────────────────
   // The shared hash-routed tab strip (@hive/shared/tabs.js) handles the
-  // active toggle + aria-selected + pane visibility + lazy fetches via
-  // onShow. Constructed in the init block below (after the fetch fns +
-  // element refs it depends on exist). `logTabs.active()` replaces the
-  // old `activeTab()`.
+  // active toggle + aria-selected + pane visibility + the SYSTEM lazy
+  // fetch via onShow. Constructed in the init block below (after the
+  // fetch fns + element refs it depends on exist). `logTabs.active()`
+  // replaces the old `activeTab()`.
   let logTabs;
 
   // ─── helpers ──────────────────────────────────────────────────────────
 
-  // Format a last-fetched timestamp: "fetched just now" / "fetched 3m ago".
-  function fmtFetchTs(fetchedAt) {
-    const ageSecs = Math.floor((Date.now() - fetchedAt) / 1000);
-    return 'fetched ' + (ageSecs < 5 ? 'just now' : fmtAgeSecs(ageSecs) + ' ago');
-  }
-
   // ─── AGENT tab ────────────────────────────────────────────────────────
 
   const agentSelect     = $('agent-select');
@@ -47,6 +39,70 @@ import { createTabStrip } from '@hive/shared/tabs.js';
   const agentOutput     = $('agent-output');
   const agentFetchTs    = $('agent-fetch-ts');
 
+  // Format a last-fetched timestamp: "fetched just now" / "fetched 3m ago".
+  function fmtFetchTs(fetchedAt) {
+    const ageSecs = Math.floor((Date.now() - fetchedAt) / 1000);
+    return 'fetched ' + (ageSecs < 5 ? 'just now' : fmtAgeSecs(ageSecs) + ' ago');
+  }
+
+  // Names from `state.infra_containers` (hive-ci / hive-forge / hive-gateway
+  // / hive-matrix) — kept in sync with the fetched list so fetchAgent() can
+  // tell an infra container apart from an agent and skip the (inapplicable)
+  // unit filter for it.
+  let infraContainerNames = new Set();
+
+  // Populate agent selector from /api/state (agents, then the four infra
+  // containers in their own optgroup), then honour any `?agent=` / `?unit=`
+  // URL params (used by the per-agent ⋮ menu's deep-link).
+  async function loadAgentList() {
+    try {
+      const resp = await fetch('/api/state');
+      if (!resp.ok) return;
+      const state = await resp.json();
+      if (!agentSelect) return;
+      agentSelect.replaceChildren();
+      agentSelect.append(el('option', { value: '' }, '— select agent —'));
+      for (const c of (state.containers || [])) {
+        agentSelect.append(el('option', { value: c.name }, c.name));
+      }
+      infraContainerNames = new Set((state.infra_containers || []).map((c) => c.name));
+      if (infraContainerNames.size) {
+        const infraGroup = el('optgroup', { label: 'infra' });
+        for (const name of infraContainerNames) {
+          infraGroup.append(el('option', { value: name }, name));
+        }
+        agentSelect.append(infraGroup);
+      }
+      // Deep-link: honour ?agent= and ?unit= URL params.
+      const urlAgent = new URLSearchParams(location.search).get('agent');
+      const urlUnit  = new URLSearchParams(location.search).get('unit');
+      if (urlAgent) {
+        const found = Array.from(agentSelect.options).some((o) => o.value === urlAgent);
+        if (found) {
+          agentSelect.value = urlAgent;
+          if (urlUnit && agentUnitSelect) {
+            const unitFound = Array.from(agentUnitSelect.options)
+              .some((o) => o.value === urlUnit);
+            if (unitFound) agentUnitSelect.value = urlUnit;
+          }
+          syncUnitSelectForSelection();
+          fetchAgent();
+        }
+      }
+    } catch { /**/ }
+  }
+
+  // Infra containers don't run the per-agent hive daemons, so the unit
+  // filter is meaningless for them — disable the selector and always fetch
+  // the full machine journal to avoid a picked unit silently doing nothing.
+  function syncUnitSelectForSelection() {
+    if (!agentUnitSelect) return;
+    const isInfra = infraContainerNames.has(agentSelect ? agentSelect.value : '');
+    agentUnitSelect.disabled = isInfra;
+    if (isInfra) agentUnitSelect.value = '';
+  }
+  if (agentSelect) agentSelect.addEventListener('change', syncUnitSelectForSelection);
+
   let agentFetching = false;
   let agentLastFetch = 0;
   async function fetchAgent() {
@@ -57,7 +113,8 @@ import { createTabStrip } from '@hive/shared/tabs.js';
     agentFetching = true;
     agentOutput.textContent = 'fetching…';
     if (agentFetchTs) agentFetchTs.hidden = true;
-    const unit = agentUnitSelect ? agentUnitSelect.value : '';
+    const isInfra = infraContainerNames.has(name);
+    const unit = (!isInfra && agentUnitSelect) ? agentUnitSelect.value : '';
     const params = new URLSearchParams({ lines: '500' });
     if (unit) params.set('unit', unit);
     try {
@@ -83,107 +140,6 @@ import { createTabStrip } from '@hive/shared/tabs.js';
   if (agentUnitSelect) agentUnitSelect.addEventListener('change', fetchAgent);
   if (agentRefresh)    agentRefresh.addEventListener('click', fetchAgent);
 
-  // ─── INFRA tab ────────────────────────────────────────────────────────
-  // Infra containers (hive-ci, hive-forge, hive-gateway, hive-matrix) don't
-  // run the per-agent hive daemons, so the unit filter is inapplicable. We
-  // always fetch the full machine journal for them.
-
-  const infraSelect  = $('infra-select');
-  const infraRefresh = $('infra-refresh');
-  const infraOutput  = $('infra-output');
-  const infraFetchTs = $('infra-fetch-ts');
-
-  let infraFetching = false;
-  let infraLastFetch = 0;
-  async function fetchInfra() {
-    if (!infraSelect || !infraOutput) return;
-    const name = infraSelect.value;
-    if (!name) { infraOutput.textContent = 'select a container above'; return; }
-    if (infraFetching) return;
-    infraFetching = true;
-    infraOutput.textContent = 'fetching…';
-    if (infraFetchTs) infraFetchTs.hidden = true;
-    const params = new URLSearchParams({ lines: '500' });
-    try {
-      const resp = await fetch('/api/journal/' + encodeURIComponent(name) + '?' + params);
-      const text = await resp.text();
-      infraOutput.textContent = resp.ok ? (text || '(empty)') : 'error ' + resp.status + '\n' + text;
-      infraOutput.scrollTop = infraOutput.scrollHeight;
-      if (resp.ok) {
-        infraLastFetch = Date.now();
-        if (infraFetchTs) {
-          infraFetchTs.textContent = fmtFetchTs(infraLastFetch);
-          infraFetchTs.hidden = false;
-        }
-      }
-    } catch (err) {
-      infraOutput.textContent = 'fetch failed: ' + err;
-    } finally {
-      infraFetching = false;
-    }
-  }
-
-  if (infraSelect)  infraSelect.addEventListener('change', fetchInfra);
-  if (infraRefresh) infraRefresh.addEventListener('click', fetchInfra);
-
-  // ─── container list init ──────────────────────────────────────────────
-  // Fetch /api/state once and populate both the AGENT selector (agents only)
-  // and the INFRA selector (infra containers only). Also handles the
-  // ?agent= / ?unit= deep-link, routing to the INFRA tab when the named
-  // container is an infra container.
-  async function loadContainerLists() {
-    try {
-      const resp = await fetch('/api/state');
-      if (!resp.ok) return;
-      const state = await resp.json();
-
-      // Populate AGENT selector (agents only — no infra optgroup).
-      if (agentSelect) {
-        agentSelect.replaceChildren();
-        agentSelect.append(el('option', { value: '' }, '— select agent —'));
-        for (const c of (state.containers || [])) {
-          agentSelect.append(el('option', { value: c.name }, c.name));
-        }
-      }
-
-      // Populate INFRA selector.
-      const infraNames = new Set((state.infra_containers || []).map((c) => c.name));
-      if (infraSelect) {
-        infraSelect.replaceChildren();
-        infraSelect.append(el('option', { value: '' }, '— select container —'));
-        for (const name of infraNames) {
-          infraSelect.append(el('option', { value: name }, name));
-        }
-      }
-
-      // Deep-link: honour ?agent= and ?unit= URL params.
-      const urlAgent = new URLSearchParams(location.search).get('agent');
-      const urlUnit  = new URLSearchParams(location.search).get('unit');
-      if (urlAgent) {
-        if (infraNames.has(urlAgent)) {
-          // Route to INFRA tab.
-          logTabs.show('infra');
-          if (infraSelect) {
-            infraSelect.value = urlAgent;
-            fetchInfra();
-          }
-        } else if (agentSelect) {
-          // Route to AGENT tab.
-          const found = Array.from(agentSelect.options).some((o) => o.value === urlAgent);
-          if (found) {
-            agentSelect.value = urlAgent;
-            if (urlUnit && agentUnitSelect) {
-              const unitFound = Array.from(agentUnitSelect.options)
-                .some((o) => o.value === urlUnit);
-              if (unitFound) agentUnitSelect.value = urlUnit;
-            }
-            fetchAgent();
-          }
-        }
-      }
-    } catch { /**/ }
-  }
-
   // ─── SYSTEM tab ───────────────────────────────────────────────────────
 
   const systemUnitSelect = $('system-unit-select');
@@ -374,7 +330,7 @@ import { createTabStrip } from '@hive/shared/tabs.js';
       else if (id === 'audit') fetchAudit();
     },
   });
-  loadContainerLists();
+  loadAgentList();
 
   // Subscribe to the dashboard SSE stream for audit live-appends.
   {
@@ -394,9 +350,6 @@ import { createTabStrip } from '@hive/shared/tabs.js';
     if (agentLastFetch && agentFetchTs && !agentFetchTs.hidden) {
       agentFetchTs.textContent = fmtFetchTs(agentLastFetch);
     }
-    if (infraLastFetch && infraFetchTs && !infraFetchTs.hidden) {
-      infraFetchTs.textContent = fmtFetchTs(infraLastFetch);
-    }
     if (systemLastFetch && systemFetchTs && !systemFetchTs.hidden) {
       systemFetchTs.textContent = fmtFetchTs(systemLastFetch);
     }
diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 905679ae..9610d605 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -1366,21 +1366,6 @@ fn validate_forge_admin_arg(arg: &str) -> Result<()> {
     Ok(())
 }
 
-/// Redact a line before it hits the (root-readable, but still
-/// unnecessarily exposed) host journal. `forgejo admin user create
-/// --random-password` prints the generated password straight to stdout —
-/// case-insensitive substring match on "password" is deliberately broad
-/// (not pinned to forgejo's exact wording, which can change across
-/// versions) so any password-bearing line gets caught rather than relying
-/// on a phrase that could silently drift out of sync.
-fn redact_password_line(line: &str) -> std::borrow::Cow<'_, str> {
-    if line.to_ascii_lowercase().contains("password") {
-        std::borrow::Cow::Borrowed("[redacted: line mentions a password]")
-    } else {
-        std::borrow::Cow::Borrowed(line)
-    }
-}
-
 /// Run `forgejo admin <args>` inside the `hive-forge` container as the
 /// `forgejo` unix user. Requires root (for nsenter into the container's
 /// namespaces). Returns `(stdout, stderr)`.
@@ -1409,10 +1394,10 @@ async fn run_forge_admin(args: &[String]) -> Result<(String, String)> {
     let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
     let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
     for line in stdout.lines() {
-        tracing::info!(target: "forgejo-admin", "{}", redact_password_line(line));
+        tracing::info!(target: "forgejo-admin", "{line}");
     }
     for line in stderr.lines() {
-        tracing::warn!(target: "forgejo-admin", "{}", redact_password_line(line));
+        tracing::warn!(target: "forgejo-admin", "{line}");
     }
     if !out.status.success() {
         bail!(
@@ -2001,26 +1986,10 @@ async fn sync_agent_tmpfiles(agents: &[String]) -> Result<(String, String)> {
 
 #[cfg(test)]
 mod tests {
-    use super::{redact_password_line, write_state_file_nofollow};
+    use super::write_state_file_nofollow;
     use std::path::PathBuf;
     use std::sync::atomic::{AtomicU32, Ordering};
 
-    #[test]
-    fn redacts_lines_mentioning_password_case_insensitively() {
-        assert_eq!(
-            redact_password_line("New password: hunter2"),
-            "[redacted: line mentions a password]"
-        );
-        assert_eq!(
-            redact_password_line("PASSWORD=hunter2"),
-            "[redacted: line mentions a password]"
-        );
-        assert_eq!(
-            redact_password_line("User \"foo\" was successfully created."),
-            "User \"foo\" was successfully created."
-        );
-    }
-
     /// Unique scratch dir per test, no external tempfile dep.
     fn scratch() -> PathBuf {
         static CTR: AtomicU32 = AtomicU32::new(0);