diff --git a/modules/nixos/desktop/networking/mihomo/README.md b/modules/nixos/desktop/networking/mihomo/README.md
index 64922dc8..d634f03e 100644
--- a/modules/nixos/desktop/networking/mihomo/README.md
+++ b/modules/nixos/desktop/networking/mihomo/README.md
@@ -62,11 +62,12 @@ Verge UI. Verge logs `Unregistered Clash configuration key "ipv6"` for the pin -
 still reaches the core.
 
 The gateway (`suzi`, not a host in this flake) runs the same config with a fixed set of deltas --
-`gateway-config.nu` renders it, `--redact` for a shareable template. Its output carries the
-subscriptions, so never commit it; the secret is filled in on the box, not here. Its binary is a
-static release build under `/usr/local/bin`, not a package: update it by hand, validate the live
-config with the new core (`mihomo -t -d /etc/mihomo -f <candidate>`) before swapping, and keep the
-previous binary. The release ships no checksums, so TLS plus `-v` is the whole verification.
+`gateway-config.nu` renders it from the same `sources.yaml` and `policy.yaml`. Its output carries
+the subscriptions and the private domains, so never commit it; the secret is filled in on the box,
+not here. Its binary is a static release build under `/usr/local/bin`, not a package: update it by
+hand, validate the live config with the new core (`mihomo -t -d /etc/mihomo -f <candidate>`) before
+swapping, and keep the previous binary. The release ships no checksums, so TLS plus `-v` is the
+whole verification.
 
 ## Why generate
 
diff --git a/modules/nixos/desktop/networking/mihomo/gateway-config.nu b/modules/nixos/desktop/networking/mihomo/gateway-config.nu
index 983c7d01..f2a61b31 100644
--- a/modules/nixos/desktop/networking/mihomo/gateway-config.nu
+++ b/modules/nixos/desktop/networking/mihomo/gateway-config.nu
@@ -5,7 +5,7 @@
 # lives. Never commit the output -- it carries the subscriptions and the private
 # domains. `secret` stays a placeholder; the deploy fills it in on the box.
 #
-#   nu gateway-config.nu [-o gateway.yaml] [--address 192.168.5.178] [--redact]
+#   nu gateway-config.nu [-o gateway.yaml] [--address 192.168.5.178]
 #   scp gateway.yaml root@<gateway>:/tmp/   # fill the secret in on the box, -t, restart
 # ---------------------------------------------------------------------------
 
@@ -16,7 +16,6 @@ def main [
   --sources (-s): path = "~/.config/mihomo/sources.yaml"
   --policy (-p): path
   --address (-a): string = "192.168.5.178"
-  --redact # replace the secret and the subscription URLs: what a shareable template needs
 ] {
   let out = ($out | path expand)
   let tmp = ($out + ".base")
@@ -49,24 +48,6 @@ def main [
         sniff: { TLS: { ports: [443] }, HTTP: { ports: [80] }, QUIC: { ports: [443] } }
       })
 
-  let gw = (if $redact {
-    # a file-backed provider (localyaml) has no url to hide
-    let pp = ($gw.proxy-providers
-      | items {|k, v| {
-        name: $k,
-        conf: (if ($v | columns | any {|c| $c == "url" }) {
-          $v | update url "https://xx.xx.xx.xx"
-        } else {
-          $v
-        })
-      } })
-    $gw
-    | update secret "NOTE-PLEASE-CHANGE-ME"
-    | update proxy-providers ($pp | reduce -f {} {|it, acc| $acc | insert $it.name $it.conf })
-  } else {
-    $gw
-  })
-
   $gw | to yaml | save -f $out
   rm $tmp
   print $"gateway config -> ($out)"