diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 48349627..c0ae6ae9 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1124,6 +1124,18 @@ in
         User = userName;
         Group = userName;
         RuntimeDirectory = "hive-matrix";
+        # Keep /run/hive-matrix across restarts. With the default
+        # `RuntimeDirectoryPreserve=no`, a `switch-to-configuration`
+        # restart races the outgoing instance's stop-time cleanup
+        # (which deletes the dir) against the incoming instance's
+        # start (which creates it + binds the socket inside it). The
+        # cleanup can win and delete the dir out from under the fresh
+        # daemon, which then fails to mkdir under root-owned /run and
+        # exits — looping on Restart=on-failure until the next boot.
+        # `yes` stops systemd removing it on stop; it still creates it
+        # on first start, and it lives on tmpfs so it's gone at
+        # container reboot regardless. See hive-bash-daemon below.
+        RuntimeDirectoryPreserve = "yes";
       };
     };
 
@@ -1155,6 +1167,13 @@ in
         User = userName;
         Group = userName;
         RuntimeDirectory = "hive-bash";
+        # See the matching note on hive-matrix-daemon. Without this, a
+        # post-rebuild restart races stop-time dir cleanup against the
+        # fresh daemon's socket-dir creation; the daemon loses, fails
+        # `mkdir /run/hive-bash` (Permission denied, non-root in /run),
+        # and loops on Restart=on-failure until the next container
+        # boot — i.e. the bash daemon "doesn't come up post-rebuild".
+        RuntimeDirectoryPreserve = "yes";
       };
     };