diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix
index dfeaa30e..37020e8c 100644
--- a/nix/host-modules/hive-forge/default.nix
+++ b/nix/host-modules/hive-forge/default.nix
@@ -581,13 +581,17 @@ in
             # just the obvious one: `forgejo-sso-source` fetches the issuer's
             # `.well-known/openid-configuration` under the store's root, and it
             # once shipped without the trust its sibling had. The collector is
-            # Go too, for the swarm collector's and authelia's names.
+            # Go too, for the swarm collector's and authelia's names. The mint
+            # unit is a consumer so that the refresh starts it: it `Requires=`
+            # forgejo, so a first boot with a late root leaves it
+            # dependency-failed and nothing else starts it.
             (caTrust.trustBundle {
               inherit pkgs;
               name = "hive-forge";
               consumers = [
                 "forgejo"
                 "forgejo-sso-source"
+                mintUnit
                 "opentelemetry-collector"
               ];
             })
diff --git a/nix/module-eval/forge-placement.nix b/nix/module-eval/forge-placement.nix
index 1c7a7ef2..79322fdc 100644
--- a/nix/module-eval/forge-placement.nix
+++ b/nix/module-eval/forge-placement.nix
@@ -391,6 +391,24 @@ let
         ))
         && lib.elem "forgejo-swarm-controller-account.service" c.swarm-bridge-dns.before;
     }
+    {
+      # A first boot with a late store root dependency-fails forgejo and the
+      # mint; the refresh's `start` is the only thing that brings the mint
+      # back. The controls are the sibling consumers in the same command, and
+      # the mint's `after`/`requires` on forgejo, which order the two
+      # `--no-block` starts.
+      name = "the forge's trust refresh starts the mint unit, and the mint stays ordered after forgejo";
+      ok =
+        let
+          c = allLocal.containers.hive-forge.config.systemd.services;
+          u = mint allLocal;
+        in
+        lib.hasInfix "systemctl start --no-block forgejo.service forgejo-sso-source.service forgejo-swarm-controller-account.service" c.hive-forge-ca-bundle-refresh.script
+        && lib.elem "hive-forge-ca-bundle.service" u.requires
+        && lib.elem "hive-forge-ca-bundle.service" u.after
+        && lib.elem "forgejo.service" u.after
+        && lib.elem "forgejo.service" u.requires;
+    }
     {
       # The mint is in the forge container's boot wait (a oneshot in
       # `multi-user.target`), so what it waits for inside its start stays under