diff --git a/.claude/tasks/0015-git-module.md b/.claude/tasks/0015-git-module.md
index c2fdb21..2ef97cb 100644
--- a/.claude/tasks/0015-git-module.md
+++ b/.claude/tasks/0015-git-module.md
@@ -22,6 +22,10 @@ It is a `Module` rather than base plumbing because a `Host` that should not carr
 The module uses `settings.user.name`/`settings.user.email`.
 Do not "fix" it back.
 
+Review on the pull request asked for the module on every host, so `enable` defaults to true rather than being restated per host, and the explicit line in `hosts/neogaia/default.nix` is gone as redundant.
+Defaulting the option keeps the opt-out this task's rationale asked for, where moving the identity into the shared base config would not.
+The `neogaia` toplevel hashes identically before and after the change.
+
 The commit name is the literal `"alexion"` rather than `config.user.name`, which review raised as duplication.
 A Unix login and a commit display name are separate concepts that merely coincide here, so binding them would let a host overriding its login silently rewrite the operator's commit identity.
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 9cfec0a..360b55f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -36,7 +36,8 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
   Both were true only while the machine still ran CachyOS against a distro Nix daemon.
 - The substituters a `nix build` fetches from are the **daemon's** (`/etc/nix/nix.conf`), *not* the `nix.settings` of the config being built — those only govern the built system.
   The two coincide here because the dev host runs this flake; they diverge on any machine that does not.
-- Git identity is declared in the flake by `modules/git.nix`, which writes `alexion <contact@alexion.dev>` — the identity all history uses — on any host enabling `modules.git`.
+- Git identity is declared in the flake by `modules/git.nix`, which writes `alexion <contact@alexion.dev>` — the identity all history uses.
+  It is one of the few modules defaulting to on, so a host carries it without restating it and declines by setting `modules.git.enable = false`.
   Once such a host has been rebuilt, a checkout on it needs no hand-written identity and keeps one across a reimage.
   Two things mask a broken module, so neither is evidence it works: this checkout's `.git/config` carries the same identity, and home-manager writes `~/.config/git/config` while a `~/.gitconfig` also exists and outranks it per key.
   That `~/.gitconfig` holds only a `tea` credential helper and no `user.*`, so it does not shadow the identity today, but it is undeclared and will not survive a reimage.
diff --git a/hosts/neogaia/default.nix b/hosts/neogaia/default.nix
index df1753f..1c04a4e 100644
--- a/hosts/neogaia/default.nix
+++ b/hosts/neogaia/default.nix
@@ -36,7 +36,6 @@
   modules.fish.enable = true;
   modules.fish.defaultShell = true;
 
-  modules.git.enable = true;
   modules.tmux.enable = true;
   modules.nvim.enable = true;
   modules.claude-code.enable = true;
diff --git a/modules/git.nix b/modules/git.nix
index bce1c24..4851dfc 100644
--- a/modules/git.nix
+++ b/modules/git.nix
@@ -9,8 +9,17 @@ let
   user = config.user.name;
 in
 {
-  options.modules.git.enable =
-    lib.mkEnableOption "git for the primary user, carrying the operator's commit identity";
+  options.modules.git.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    description = ''
+      Whether to configure git for the primary user, carrying the operator's
+      commit identity.
+
+      On by default, so every host can commit without restating it. A host that
+      should not carry a personal commit identity sets this to false.
+    '';
+  };
 
   config = lib.mkIf cfg.enable {
     home-manager.users.${user}.programs.git = {