diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index b36cfb45..6863ce03 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -807,18 +807,27 @@ in
               # forge.darkest.space, etc.) were failing every sync
               # attempt without this.
               migrations.ALLOWED_DOMAINS = "*";
-              # `ALLOWED_HOST_LIST` is forgejo's webhook SSRF allow-list, and
-              # it's a STRICT whitelist (only listed hosts deliver). Its
-              # default is the `external` builtin: all public unicast IPs are
-              # allowed, private/loopback denied. We must KEEP `external` so
-              # user-repo webhooks to public hosts (github, slack, …) keep
-              # working, and ADD the hive gateway host on top: the config-PR +
-              # knowledge webhooks target `https://<hyperhive domain>/webhook/*`,
-              # which resolves to a private (RFC-1918) gateway IP that
-              # `external` alone would deny (so they'd only ever be caught by
-              # the 5-min poll fallback). Naming the single gateway host is
-              # tighter than the broad `private` builtin.
-              webhook.ALLOWED_HOST_LIST = "external,${hyperhiveDomain}";
+              # Forgejo's webhook SSRF allow-list, a strict whitelist.
+              # `external` (public unicast only) stays, or user-repo webhooks to
+              # github/slack break; both hyperhive hosts are added because their
+              # webhooks target a private gateway IP `external` denies. The
+              # swarm's host was the missing one, and every swarm-controller
+              # delivery was refused for it.
+              #
+              # Not gated on `deploy.swarm-ui.enable`: in a spread deployment the
+              # forge and the swarm host are different machines, so that
+              # per-host flag is false exactly where this entry is needed.
+              # `swarm.ui.domain` is the option the controller builds its public
+              # URL from; it is slated to collapse into `swarm.domain`.
+              webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," (
+                lib.unique (
+                  [
+                    "external"
+                    hyperhiveDomain
+                  ]
+                  ++ lib.optional (swarmDomain != null) config.services.hyperhive.swarm.ui.domain
+                )
+              );
               log.LEVEL = "Warn";
               # Pinned explicitly rather than left to upstream's default
               # (currently `bleve`, a separate full-text index Forgejo