diff --git a/scripts/gc-hosts.sh b/scripts/gc-hosts.sh
index 2538263..c2dd6f1 100755
--- a/scripts/gc-hosts.sh
+++ b/scripts/gc-hosts.sh
@@ -23,6 +23,7 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 source scripts/env.sh 2>/dev/null || true
+source scripts/lib/nix-eval.sh 2>/dev/null || true
 
 # ── config ────────────────────────────────────────────────────────────────────
 
@@ -74,11 +75,21 @@ _add_host "pve1" "${PVE1_SSH_USER}@${PVE1_HOST}" "nix"
 # create-proxmox-resource.sh names every guest after its NixOS hostname:
 #   pct create ... --hostname <nixos-hostname>  (LXC)
 #   qm  create ... --name    <nixos-hostname>   (VM)
-# So pct list / qm list output already contains the NixOS hostname directly —
-# no flake eval or name translation needed.
+# So pct/qm list output already contains the NixOS hostname directly.
+# We validate against the flake to filter out non-NixOS guests on pve1
+# (e.g. FreeIPA, Proxmox Backup Server) that share the same Proxmox node.
 echo "Discovering running guests on ${PVE1_HOST}..."
 
-# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if wayne's sudo needs a password.
+# Eval the flake once to get the set of hostnames that are actually NixOS.
+# Values are NixOS hostnames (e.g. "docker"); keys are flake targets ("lxc-docker").
+nixos_hostnames=""
+nixos_hostnames="$(
+  nix eval --json "${NIX_EVAL_FLAGS[@]}" .#nixosConfigurations \
+    --apply 'cfgs: builtins.attrValues (builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs)' \
+    2>/dev/null | jq -r '.[]' | sort -u
+)" || { echo "  warning: flake eval failed — non-NixOS guests will not be filtered" >&2; }
+
+# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if needed for pct/qm.
 if ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" "true" 2>/dev/null; then
   running_guests="$(
     ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash -s <<'DISCOVER'
@@ -91,6 +102,10 @@ DISCOVER
     [[ -z "$hostname" ]] && continue
     # Exclude nix-cache.
     case "$hostname" in *nix-cache*) continue ;; esac
+    # Skip if not a flake-managed NixOS host (filters non-NixOS pve1 guests).
+    if [[ -n "$nixos_hostnames" ]] && ! grep -qxF "$hostname" <<< "$nixos_hostnames"; then
+      continue
+    fi
     # Skip if already in the list (e.g. a proxmox-gui guest whose hostname is nixos).
     if [[ -n "${_SEEN_HOSTNAMES[$hostname]+_}" ]]; then continue; fi