diff --git a/modules/clan/router/dns-dhcp.nix b/modules/clan/router/dns-dhcp.nix
index 850b28a..e69291d 100644
--- a/modules/clan/router/dns-dhcp.nix
+++ b/modules/clan/router/dns-dhcp.nix
@@ -56,10 +56,9 @@ in
     };
   };
 
-  systemd.services.kea-dhcp4-server.serviceConfig = {
-    Restart = "on-failure";
-    RestartSec = 5;
-  };
+  # The nixpkgs unit already has Restart=on-failure; space the restarts out so
+  # a persistent bind failure does not trip the start-rate limit.
+  systemd.services.kea-dhcp4-server.serviceConfig.RestartSec = 5;
 
   services.blocky = {
     enable = true;