diff --git a/nix/host-modules/hive-ci.nix b/nix/host-modules/hive-ci.nix
index d4bbfac1..8c82c80a 100644
--- a/nix/host-modules/hive-ci.nix
+++ b/nix/host-modules/hive-ci.nix
@@ -351,10 +351,28 @@ in
     # generated by the host `hive-tls-ca` service. Order the container after
     # it so the bind source exists before nspawn sets the mount up (a
     # condition-skipped/late CA would otherwise fail the container start).
-    systemd.services."container@hive-ci" = lib.mkIf useSelfSigned {
-      after = [ "hive-tls-ca.service" ];
-      requires = [ "hive-tls-ca.service" ];
-    };
+    systemd.services."container@hive-ci" = lib.mkMerge [
+      (lib.mkIf useSelfSigned {
+        after = [ "hive-tls-ca.service" ];
+        requires = [ "hive-tls-ca.service" ];
+      })
+      {
+        # gitea-runner registration (hive-ci-prefetch, host-side)
+        # sits on the boot-critical path — the container's nspawn readiness
+        # is gated on the runner registering, a forge + core-token round
+        # trip that itself waits up to 60s for the core token. The default
+        # nspawn `TimeoutStartSec` (~60s, systemd's `DefaultTimeoutStartSec`)
+        # can therefore trip mid-register, especially right after a
+        # `.runner`-purge (every boot re-registers from scratch — see
+        # hive-ci-prefetch above) or during a hive-c0re restart storm that
+        # delays the core token. systemd then kills the half-started
+        # container and reschedules, producing an observed ~60s restart
+        # loop until the forge/token settle. Bumping the timeout well past
+        # the prefetch's own 60s wait gives one register attempt room to
+        # actually finish instead of being killed mid-flight.
+        serviceConfig.TimeoutStartSec = "180s";
+      }
+    ];
 
     containers.hive-ci = {
       autoStart = true;