diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index cdb3f9df..789aa045 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -162,7 +162,16 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
     match req {
         PrivRequest::StartContainer { ref name } => {
             validate_container_name(name)?;
-            container_run(&["start", &container_system_name(name)]).await
+            let machine = container_system_name(name);
+            // Clear any start-limit lockout left by earlier failures so a
+            // now-correct start isn't blocked. nixos-container start does not
+            // do this itself. Best-effort: if the unit doesn't exist yet
+            // (first-time create) reset-failed is a no-op and we proceed.
+            let _ = Command::new("systemctl")
+                .args(["reset-failed", &format!("container@{machine}.service")])
+                .status()
+                .await;
+            container_run(&["start", &machine]).await
         }
 
         PrivRequest::StopContainer { ref name } => {