diff --git a/nix/hosts/cc-ci-hetzner/networking.nix b/nix/hosts/cc-ci-hetzner/networking.nix
index e2c58a1..dde909e 100644
--- a/nix/hosts/cc-ci-hetzner/networking.nix
+++ b/nix/hosts/cc-ci-hetzner/networking.nix
@@ -14,7 +14,18 @@
       "185.12.64.1"
       "185.12.64.2"
     ];
-    defaultGateway = "172.31.1.1";
+    # The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
+    # module installs the default route from the gateway interface's
+    # network-addresses-<iface>.service, and it finds that interface either by
+    # `defaultGateway.interface` or by the gateway address being inside one of the
+    # interface's subnets. With Hetzner's off-subnet point-to-point gateway
+    # (91.98.47.73/32 on eth0, gateway 172.31.1.1) neither matched when this was a
+    # bare string, so NO default route was installed and the 26.05 rebuild on
+    # 2026-08-03 took the host off the network (recovered via rescue mode).
+    defaultGateway = {
+      address = "172.31.1.1";
+      interface = "eth0";
+    };
     # No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
     # defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
     # ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.