diff --git a/nix/agent-modules/network.nix b/nix/agent-modules/network.nix
index bf9f9d6a..e6ad054c 100644
--- a/nix/agent-modules/network.nix
+++ b/nix/agent-modules/network.nix
@@ -44,8 +44,9 @@
     # bridge dnsmasq (gateway IP) is. hive-priv drops the marker
     # `/etc/hyperhive-bridge-dns` (containing the gateway IP) since
     # isolation is always on; the oneshot reads it and rewrites
-    # resolv.conf on every boot. Ordered before the first DNS consumer
-    # (the forge-token fetch) and the network targets so name resolution works for
+    # resolv.conf on every boot. Ordered before the first DNS consumers
+    # (the forge-token, bao-identity, github-token and forge-accounts
+    # oneshots) and the network targets so name resolution works for
     # the very first turn.
     systemd.services.hyperhive-isolated-dns = {
       description = "point resolv.conf at the hive bridge resolver (isolated containers)";
@@ -58,10 +59,15 @@
       # edge the harness can start before we've fixed resolv.conf and the
       # first turn errors — self-heals next turn, but better not to flap).
       # `hive-matrix-daemon` likewise syncs over the network; the `before`
-      # is a harmless no-op when matrix is disabled (the unit is absent).
+      # is a harmless no-op when matrix is disabled (the unit is absent);
+      # so are the bao-identity / github-token / forge-accounts edges on
+      # agents that don't enable those oneshots.
       before = [
         "network-online.target"
         "hive-agent-forge-token.service"
+        "hive-agent-bao-identity.service"
+        "hive-agent-github-token.service"
+        "hive-agent-forge-accounts.service"
         "hive-agent.service"
         "hive-matrix-daemon.service"
       ];