diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index 0c589e0a..9a5b5c81 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -248,6 +248,17 @@ in
       ];
       before = [ "nixos-container@hive-ci.service" ];
       wantedBy = [ "nixos-container@hive-ci.service" ];
+      # partOf binds this oneshot's lifecycle to the container: when the
+      # container is stopped or restarted, systemd propagates that to this
+      # unit so it re-runs on the NEXT container start. Without this, the
+      # RemainAfterExit=true oneshot stays "active (exited)" forever after
+      # its first run — so a container restart skips it and the stale
+      # runner-token file (a placeholder from a boot where the forge token
+      # wasn't ready yet, or a registration token consumed/rotated since)
+      # is never refreshed. The in-container register service then fails
+      # with "runner registration token not found". partOf guarantees a
+      # fresh token is fetched before every container (re)start.
+      partOf = [ "nixos-container@hive-ci.service" ];
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;