diff --git a/hw/dixie/analysis.nix b/hw/dixie/analysis.nix
index e166cef..7b548f7 100644
--- a/hw/dixie/analysis.nix
+++ b/hw/dixie/analysis.nix
@@ -14,12 +14,11 @@
 # NOT declarative — it runs once as an imperative step during deploy (see below).
 #
 # HDD wipe (authorized for sda = WDC WD6003FZBX-00K5WB0, serial V7G47PKH only):
-#   doas smartctl -i -d sat /dev/sda          # confirm model+serial first
-#   doas wipefs -a /dev/sda                    # drop BitLocker sig + GPT
-#   doas sgdisk --zap-all /dev/sda            # remove any leftover partition table
-#   doas sgdisk -n 0:0:+0 -t 0:8300 -c 0:dropsonde-cold /dev/sda
-#   doas mkfs.xfs -L dropsonde-cold /dev/sda1
-# One GPT partition, XFS, label dropsonde-cold. sdb (stick) and nvme0n1 (root) untouched.
+#   wipefs -a /dev/sda2 /dev/sda1 /dev/sda     # partitions first, then the disk
+#   printf 'label: gpt\n,,L\n' | sfdisk /dev/sda   # GPT + one Linux span
+#   udevadm settle
+#   mkfs.xfs -L ds2-cold /dev/sda1
+# One GPT partition, XFS, label ds2-cold. sdb (stick) and nvme0n1 (root) untouched.
 #
 # Password: generated on dixie as root, never committed:
 #   umask 077; openssl rand -base64 32 > /root/dropsonde-pg
@@ -50,8 +49,11 @@ in
     # --- /srv/cold (5.5 TB HDD, by label) -------------------------------------
     # The wipe+format of sda happens once during deploy; this entry just mounts
     # by label with nofail so a missing disk never blocks boot.
+    # Label is ds2-cold (8 chars; XFS caps labels at 12). Not "dropsonde-cold":
+    # hyperborea's NVMe is already labelled "dropsonde", and duplicate labels
+    # across hosts is a footgun.
     fileSystems."/srv/cold" = {
-      device = "/dev/disk/by-label/dropsonde-cold";
+      device = "/dev/disk/by-label/ds2-cold";
       fsType = "xfs";
       options = [ "noatime" "nofail" "x-systemd.device-timeout=30s" ];
     };