diff --git a/hub/cmd/hub/main.go b/hub/cmd/hub/main.go
index 9d24d9d..e5d26d2 100644
--- a/hub/cmd/hub/main.go
+++ b/hub/cmd/hub/main.go
@@ -319,6 +319,9 @@ func main() {
 	// v0.44.0-agent: operator alert when an agent reports a degraded privileged capability (a missing
 	// `sudo -n` grant — the 2026-06-28 cutover class). Same 60s sweep + transition/cooldown plumbing.
 	hostCapabilityChecker := monitor.NewHostCapabilityChecker(dataStore, dispatcher.ProcessEvent, logger)
+	// agent-v0.48.0: proactive fleet-wide agent-re-key detection — alert when a host's reported
+	// local-API leaf fingerprint changes (independent of the controller channel-check). Same 60s sweep.
+	hostLeafChecker := monitor.NewHostLeafChecker(dataStore, dispatcher.ProcessEvent, logger)
 	go func() {
 		ticker := time.NewTicker(60 * time.Second)
 		defer ticker.Stop()
@@ -330,6 +333,7 @@ func main() {
 				stalenessChecker.Check()
 				hostStalenessChecker.Check()
 				hostCapabilityChecker.Check()
+				hostLeafChecker.Check()
 			}
 		}
 	}()