diff --git a/modules/clan/router/dns-dhcp.nix b/modules/clan/router/dns-dhcp.nix
index 491e066..850b28a 100644
--- a/modules/clan/router/dns-dhcp.nix
+++ b/modules/clan/router/dns-dhcp.nix
@@ -12,7 +12,19 @@ in
   services.kea.dhcp4 = {
     enable = true;
     settings = {
-      interfaces-config.interfaces = lib.mapAttrsToList (name: _: "vlan-${name}") dhcpVlans;
+      interfaces-config = {
+        interfaces = lib.mapAttrsToList (name: _: "vlan-${name}") dhcpVlans;
+        # The unit orders after network-online.target, which under networkd
+        # only waits for the WAN carrier (the vlan-* links are
+        # RequiredForOnline=no), so Kea can start before vlan-* have their
+        # addresses. By default it then logs the failed bind and runs with no
+        # socket at all: clients' DISCOVERs reach vlan-lan and nobody answers.
+        # Insist on every socket and keep retrying while networkd catches up;
+        # if it still cannot bind, exit and let systemd restart the unit.
+        service-sockets-require-all = true;
+        service-sockets-max-retries = 60;
+        service-sockets-retry-wait-time = 1000;
+      };
       lease-database = {
         type = "memfile";
         persist = true;
@@ -44,6 +56,11 @@ in
     };
   };
 
+  systemd.services.kea-dhcp4-server.serviceConfig = {
+    Restart = "on-failure";
+    RestartSec = 5;
+  };
+
   services.blocky = {
     enable = true;
     settings = {