diff --git a/terraform/modules/envs/dev.tf b/terraform/modules/envs/dev.tf
index dcb27e5..dedf772 100644
--- a/terraform/modules/envs/dev.tf
+++ b/terraform/modules/envs/dev.tf
@@ -31,21 +31,6 @@ locals {
         nodes = {
           hydrant    = { name = "hyd-gcp-eu-1", cell = "eu", zone = "europe-north1-a", internal_ip = "10.166.15.10", tunnel = true }
           knotmirror = { url = "https://mirror-fsn.tangled.network" }
-          # hostname is its did:web, so changing it orphans every grant it holds
-          migrator = {
-            name        = "migrator-eu-1"
-            cell        = "eu"
-            zone        = "europe-north1-a"
-            internal_ip = "10.166.0.3"
-            hostname    = "migrator-dev.tangled.network"
-          }
-          knot = {
-            name        = "knot-eu-1"
-            cell        = "eu"
-            zone        = "europe-north1-a"
-            internal_ip = "10.166.15.12"
-            hostname    = "knot.next.tangled.network"
-          }
         }
 
         cells = {
@@ -75,6 +60,25 @@ locals {
       }
     }
 
+    # not in a hub because no bobbin reads them, so a `cell` only places them
+    nodes = {
+      # hostname is its did:web, so changing it orphans every grant it holds
+      migrator = {
+        name        = "migrator-eu-1"
+        cell        = "eu"
+        zone        = "europe-north1-a"
+        internal_ip = "10.166.0.3"
+        hostname    = "migrator-dev.tangled.network"
+      }
+      knot = {
+        name        = "knot-eu-1"
+        cell        = "eu"
+        zone        = "europe-north1-a"
+        internal_ip = "10.166.15.12"
+        hostname    = "knot.next.tangled.network"
+      }
+    }
+
     # workers/<env> deploys these from the bundles deploy builds, keyed by their dir in core
     cloudflare = {
       account_id = "475a0795ff814187be629061103e5ba7"
diff --git a/terraform/modules/envs/kinds.tf b/terraform/modules/envs/kinds.tf
index 172461d..e9709d1 100644
--- a/terraform/modules/envs/kinds.tf
+++ b/terraform/modules/envs/kinds.tf
@@ -1,6 +1,7 @@
-# what a hub's nodes can be, by kind, one of each per hub. a node with a `url` is one we don't
-# run, the rest are vms the nodes root makes, serving http on port 80 inside the vpc. either
-# way bobbin gets the address through the env vars named here.
+# what a node can be, by kind, one of each per hub or env. hydrant and knotmirror sit in a hub and
+# give bobbin their address through the env vars named here, the rest sit in an env's `nodes` and
+# nothing reads them. a node with a `url` is one we don't run, the rest are vms the nodes root
+# makes, serving http on port 80 inside the vpc.
 #
 # a kind with `public` ports answers the internet on them itself, from an address that outlives
 # its vm, and its node names that address with `hostname`. `secrets` are secret manager ids the
diff --git a/terraform/modules/envs/outputs.tf b/terraform/modules/envs/outputs.tf
index 306ed56..ea7a7a7 100644
--- a/terraform/modules/envs/outputs.tf
+++ b/terraform/modules/envs/outputs.tf
@@ -40,28 +40,30 @@ locals {
         cell => local.cells[name][cell]
       }
 
-      # the ones the nodes root makes. the region comes from the hub's own cells, so a node
-      # placed outside them fails the plan
-      nodes = { for n in flatten([
-        for hub in values(e.hubs) : [for kind, n in hub.nodes : merge(
-          {
-            machine_type = local.kinds[kind].machine_type
-            disk_gb      = local.kinds[kind].disk_gb
-            hostname     = null
-            tunnel       = false
-          },
-          n,
-          {
-            kind     = kind
-            system   = local.kinds[kind].system
-            tag      = local.kinds[kind].tag
-            region   = hub.cells[n.cell].region
-            public   = try(local.kinds[kind].public, null)
-            secrets  = concat(try(local.kinds[kind].secrets, []), try(n.tunnel, false) ? ["cloudflared-${n.name}"] : [])
-            ssh_port = try(local.kinds[kind].ssh_port, 22)
-          },
-        ) if !can(n.url)]
-      ]) : n.name => n }
+      # the ones the nodes root makes: the hubs' own, then the env's standalone `nodes` that no
+      # bobbin reads. the region comes from the env's cells, so a node placed outside them fails
+      # the plan
+      nodes = { for p in concat(
+        flatten([for hub in values(e.hubs) : [for kind, n in hub.nodes : { kind = kind, n = n } if !can(n.url)]]),
+        [for kind, n in try(e.nodes, {}) : { kind = kind, n = n }],
+        ) : p.n.name => merge(
+        {
+          machine_type = local.kinds[p.kind].machine_type
+          disk_gb      = local.kinds[p.kind].disk_gb
+          hostname     = null
+          tunnel       = false
+        },
+        p.n,
+        {
+          kind     = p.kind
+          system   = local.kinds[p.kind].system
+          tag      = local.kinds[p.kind].tag
+          region   = local.cells[name][p.n.cell].region
+          public   = try(local.kinds[p.kind].public, null)
+          secrets  = concat(try(local.kinds[p.kind].secrets, []), try(p.n.tunnel, false) ? ["cloudflared-${p.n.name}"] : [])
+          ssh_port = try(local.kinds[p.kind].ssh_port, 22)
+        },
+      ) }
     })
   }
 }