diff --git a/docker-compose.yml b/docker-compose.yml
index 66b70df27..6046fe172 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -49,8 +49,8 @@ services:
     environment:
       PDS_URL: http://pds:3000
       OWNER_USER: alice
-      KNOT_HOSTNAME: knot.tngl.boltless.dev
-      KNOT2_HOSTNAME: knot2.tngl.boltless.dev
+      GO_KNOT_HOSTNAME: knot.tngl.boltless.dev
+      KNOT_HOSTNAME: knot2.tngl.boltless.dev
       SPINDLE_HOSTNAME: spindle.tngl.boltless.dev
     volumes:
       - ./localinfra/scripts:/scripts:ro
@@ -67,10 +67,10 @@ services:
     env_file: localinfra/pds.env
     environment:
       PDS_URL: http://pds:3000
-      KNOT_URL: http://knot:5555
-      KNOT_HOSTNAME: knot.tngl.boltless.dev
-      KNOT2_URL: http://knot2:5555
-      KNOT2_HOSTNAME: knot2.tngl.boltless.dev
+      GO_KNOT_URL: http://knot:5555
+      GO_KNOT_HOSTNAME: knot.tngl.boltless.dev
+      KNOT_URL: http://knot2:5555
+      KNOT_HOSTNAME: knot2.tngl.boltless.dev
     volumes:
       - ./localinfra/scripts:/scripts:ro
       - init-state:/shared:ro
diff --git a/localinfra/scripts/init-accounts.sh b/localinfra/scripts/init-accounts.sh
index 2da85ac96..69f8c8fe3 100644
--- a/localinfra/scripts/init-accounts.sh
+++ b/localinfra/scripts/init-accounts.sh
@@ -138,8 +138,8 @@ printf '%s' "$LABEL_DEFAULTS" > "${SHARED_DIR}/label-defaults"
 printf '[env] wrote label-defaults, label-gfi\n' >&2
 
 # service definitions (under OWNER_DID)
+put_record "at://$OWNER_DID/sh.tangled.knot/$GO_KNOT_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null
 put_record "at://$OWNER_DID/sh.tangled.knot/$KNOT_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null
-put_record "at://$OWNER_DID/sh.tangled.knot/$KNOT2_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null
 put_record "at://$OWNER_DID/sh.tangled.spindle/$SPINDLE_HOSTNAME" "{\"createdAt\": \"${CREATED_AT}\"}" >/dev/null
 
 printf 'done.\n' >&2
diff --git a/localinfra/scripts/init-data.sh b/localinfra/scripts/init-data.sh
index a84096348..c68174ecf 100644
--- a/localinfra/scripts/init-data.sh
+++ b/localinfra/scripts/init-data.sh
@@ -1,11 +1,12 @@
 #!/bin/sh
 set -eu
 
+: "${GO_KNOT_URL:?GO_KNOT_URL must be set}"
+: "${GO_KNOT_HOSTNAME:?GO_KNOT_HOSTNAME must be set}"
 : "${KNOT_URL:?KNOT_URL must be set}"
 : "${KNOT_HOSTNAME:?KNOT_HOSTNAME must be set}"
-: "${KNOT2_URL:?KNOT2_URL must be set}"
-: "${KNOT2_HOSTNAME:?KNOT2_HOSTNAME must be set}"
 : "${PDS_HOSTNAME:?PDS_HOSTNAME must be set}"
+KNOT_DID=did:web:$KNOT_HOSTNAME
 
 SHARED_DIR="${SHARED_DIR:-/shared}"
 
@@ -20,12 +21,10 @@ BOB_JWT=$(login "$BOB_DID")
 CHARLIE_DID=$(resolve_handle "charlie.${PDS_HOSTNAME}")
 DAVID_DID=$(resolve_handle "david.${PDS_HOSTNAME}")
 
-CORE_SOURCE=https://tangled.org/boltless.me/core.archive
-CORE_SOURCE_DIRECT=https://knot1.tangled.sh/did:plc:ioighzh4jnrhybayw65gfbia
+CORE_SOURCE=https://knot1.tangled.sh/did:plc:ioighzh4jnrhybayw65gfbia
 
 # every record this script seeds, and who authors it
 REPO_CORE=at://$OWNER_DID/sh.tangled.repo/core
-REPO_CORE_KNOT2=at://$OWNER_DID/sh.tangled.repo/core.knot2
 REPO_EMPTY=at://$BOB_DID/sh.tangled.repo/empty-repo
 
 ISSUE_1=at://$OWNER_DID/sh.tangled.repo.issue/3lzg6f3aia222
@@ -67,45 +66,24 @@ VOUCH_BOB_DAVID=at://$BOB_DID/sh.tangled.graph.vouch/$DAVID_DID
 
 # knot2
 (
-  KNOT_HOSTNAME=$KNOT2_HOSTNAME
-  KNOT_URL=$KNOT2_URL
-
   # idempotent: the knot no-ops a subject that is already a member or an admin
   for did in "$BOB_DID" "$CHARLIE_DID" "$DAVID_DID"; do
     curl -fsS -o /dev/null -X POST \
       -H "Content-Type: application/json" \
-      -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.knot.addMember)" \
+      -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.knot.addMember "$KNOT_DID")" \
       -d "$(jq -nc --arg subject "$did" '{subject:$subject}')" \
       "${KNOT_URL}/xrpc/sh.tangled.knot.addMember"
     printf '[knot2] member %s\n' "$did" >&2
   done
-
-  # same upstream as the go knot's core, via $CORE_SOURCE_DIRECT for the reason noted
-  # there. a fork adopts the source's object format, so this lands as sha1 despite
-  # knot2 defaulting to sha256.
-  KNOT2_CORE_DID=$(curl -fsS \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.repo.create)" \
-    -d "$(jq -nc --arg source "$CORE_SOURCE_DIRECT" \
-      '{rkey:"core.knot2", name:"core.knot2", defaultBranch:"master", source:$source}')" \
-    "${KNOT_URL}/xrpc/sh.tangled.repo.create" | jq -er '.repoDid')
-
-  printf '[knot2] core.knot2 = %s\n' "$KNOT2_CORE_DID" >&2
-
-  put_record "$REPO_CORE_KNOT2" "$(jq -nc \
-    --arg knot "$KNOT_HOSTNAME" \
-    --arg repoDid "$KNOT2_CORE_DID" \
-    --arg source "$CORE_SOURCE_DIRECT" \
-    --arg createdAt "$CREATED_AT" \
-    '{knot:$knot, name:"core.knot2", repoDid:$repoDid, source:$source,
-      createdAt:$createdAt}')" >/dev/null
 )
 
 # --- repo fixtures ---
 
+# a fork adopts the source's object format, so this lands as sha1 despite knot2
+# defaulting to sha256.
 REPO_DID=$(curl -fsS \
   -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.repo.create)" \
+  -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.repo.create "$KNOT_DID")" \
   -d "$(jq -nc --arg source "$CORE_SOURCE" \
     '{rkey:"core", name:"core", defaultBranch:"master", source:$source}')" \
   "${KNOT_URL}/xrpc/sh.tangled.repo.create" | jq -er '.repoDid')
@@ -119,16 +97,9 @@ put_record "$REPO_CORE" "$(jq -nc \
   --arg createdAt "$CREATED_AT" \
   '{knot:$knot, name:"core", repoDid:$repoDid, source:$source, createdAt:$createdAt}')" >/dev/null
 
-# bob needs server:member on the knot before he may create a repo there
-curl -fsS -X POST \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $(service_token "$OWNER_JWT" sh.tangled.knot.addMember)" \
-  -d "$(jq -nc --arg subject "$BOB_DID" '{subject:$subject}')" \
-  "${KNOT_URL}/xrpc/sh.tangled.knot.addMember"
-
 EMPTY_REPO_DID=$(curl -fsS \
   -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $(service_token "$BOB_JWT" sh.tangled.repo.create)" \
+  -H "Authorization: Bearer $(service_token "$BOB_JWT" sh.tangled.repo.create "$KNOT_DID")" \
   -d '{"rkey":"empty-repo", "name":"empty-repo", "defaultBranch":"master"}' \
   "${KNOT_URL}/xrpc/sh.tangled.repo.create" | jq -er '.repoDid')
 
@@ -240,7 +211,7 @@ keep_commit() {
 
   curl -fsS \
     -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $(service_token "$(login "$did")" sh.tangled.git.keepCommit)" \
+    -H "Authorization: Bearer $(service_token "$(login "$did")" sh.tangled.git.keepCommit "$KNOT_DID")" \
     -d "$(jq -nc --arg repo "$1" --arg oid "$2" --arg record "$3" \
       '{repo:$repo, record:$record,
         source:{"$type":"sh.tangled.git.keepCommit#commit", repo:$repo, oid:$oid}}')" \
diff --git a/localinfra/scripts/lib.sh b/localinfra/scripts/lib.sh
index 7e1f8ae76..ff71059c2 100644
--- a/localinfra/scripts/lib.sh
+++ b/localinfra/scripts/lib.sh
@@ -26,10 +26,10 @@ login() {
     | jq -er '.accessJwt'
 }
 
-# service_token JWT LXM → service auth JWT for the knot, on stdout.
+# service_token JWT LXM [AUD] → service auth JWT for the knot, on stdout.
+# AUD defaults to the did:web of $KNOT_HOSTNAME.
 service_token() {
-  : "${KNOT_HOSTNAME:?KNOT_HOSTNAME must be set}"
-  aud="did:web:$(printf '%s' "$KNOT_HOSTNAME" | sed 's/:/%3A/g')"
+  aud=${3:-"did:web:$(printf '%s' "${KNOT_HOSTNAME:?KNOT_HOSTNAME must be set}" | sed 's/:/%3A/g')"}
 
   curl -fsS -H "Authorization: Bearer $1" \
     "${PDS_URL}/xrpc/com.atproto.server.getServiceAuth?aud=${aud}&lxm=$2&exp=$(( $(date +%s) + 240 ))" \