diff --git a/systemd/README.md b/systemd/README.md
index a8525e3..a32ec1c 100644
--- a/systemd/README.md
+++ b/systemd/README.md
@@ -12,6 +12,7 @@ an env file in `systemd/instances/`:
 
 ```sh
 LRIS2_DAEMON=<path relative to daemons/, e.g. vacuum-gauge>
+LRIS2_HOST=<the host it belongs on, so deploy refuses the wrong one>
 ```
 
 Its config is `/etc/lris2/<name>.yaml`, deployed there from
diff --git a/systemd/instances/keygrabber.env b/systemd/instances/keygrabber.env
index 7d22489..dc737c1 100644
--- a/systemd/instances/keygrabber.env
+++ b/systemd/instances/keygrabber.env
@@ -8,3 +8,4 @@
 # The InfluxDB token goes in root-only /etc/lris2/secrets.env, not here:
 #   LRIS2_INFLUX_TOKEN=<token>
 LRIS2_DAEMON=keygrabber
+LRIS2_HOST=lris2
diff --git a/systemd/instances/rcam.env b/systemd/instances/rcam.env
index a5ebadf..e2bb314 100644
--- a/systemd/instances/rcam.env
+++ b/systemd/instances/rcam.env
@@ -8,3 +8,4 @@
 # Needs the instrument's camera_interface build in the venv, which is not a
 # git dependency: pip install <lris2-camerad-instrument>
 LRIS2_DAEMON=camera
+LRIS2_HOST=lris2
diff --git a/systemd/instances/rcryo.env b/systemd/instances/rcryo.env
index a717f3a..3ec642c 100644
--- a/systemd/instances/rcryo.env
+++ b/systemd/instances/rcryo.env
@@ -5,3 +5,4 @@
 # Deployed alongside this file by the CLI:
 #   config/<subsystem>/rcryo.yaml -> /etc/lris2/rcryo.yaml
 LRIS2_DAEMON=cryocooler
+LRIS2_HOST=lris2
diff --git a/systemd/instances/rpress.env b/systemd/instances/rpress.env
index 8aecf69..c82630b 100644
--- a/systemd/instances/rpress.env
+++ b/systemd/instances/rpress.env
@@ -5,3 +5,4 @@
 # Deployed alongside this file by the CLI:
 #   config/<subsystem>/rpress.yaml -> /etc/lris2/rpress.yaml
 LRIS2_DAEMON=vacuum-gauge
+LRIS2_HOST=lris2