diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 18278a49..80331efb 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1040,9 +1040,19 @@ in
       description = "point resolv.conf at the hive bridge resolver (isolated containers)";
       wantedBy = [ "multi-user.target" ];
       after = [ "local-fs.target" ];
+      # Ordered before every network consumer that does DNS on first
+      # boot. `hive-ag3nt` (the harness) is the load-bearing one: its
+      # first-turn api.anthropic.com lookup must not race the resolv.conf
+      # rewrite (it only declares `after network.target`, so without this
+      # edge the harness can start before we've fixed resolv.conf and the
+      # first turn errors — self-heals next turn, but better not to flap).
+      # `hive-matrix-daemon` likewise syncs over the network; the `before`
+      # is a harmless no-op when matrix is disabled (the unit is absent).
       before = [
         "network-online.target"
         "tea-login.service"
+        "hive-ag3nt.service"
+        "hive-matrix-daemon.service"
       ];
       unitConfig.ConditionPathExists = "/etc/hyperhive-bridge-dns";
       serviceConfig = {