diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index 2e6eaaba..d8e82df7 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -184,6 +184,11 @@ in
     # its next boot will import the already-rotated leaf anyway.
     systemd.services.hive-tls-resign = {
       description = "Re-sign the gateway TLS leaf and propagate it into the gateway container";
+      # hive-tls-ca must have run first so the CA key exists before we try
+      # to re-sign under it. On first boot `Persistent=true` on the weekly
+      # timer fires immediately; without this ordering the resign could race
+      # the CA initialisation and fail with "no such file" on the CA key.
+      after = [ "hive-tls-ca.service" ];
       path = [
         pkgs.openssl
         pkgs.coreutils