diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index a03c747d..ca227aea 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -1420,6 +1420,16 @@ fn write_bridge_dns_marker(container: &str, isolation: Option<&NetworkIsolation>
     let path = bridge_dns_marker_path(container);
     match isolation {
         Some(iso) => {
+            // On a fresh install the container's `/etc` may not exist yet
+            // (rootfs not fully materialised before the first start), so
+            // `write` would fail with ENOENT. Create the parent dir first
+            // — it's the container's own `/etc`, which nixos-container
+            // populates on start; a pre-created dir + our marker persist.
+            if let Some(parent) = std::path::Path::new(&path).parent() {
+                std::fs::create_dir_all(parent).with_context(|| {
+                    format!("create bridge-DNS marker dir {}", parent.display())
+                })?;
+            }
             std::fs::write(&path, format!("{}\n", iso.gateway_ip))
                 .with_context(|| format!("write bridge-DNS marker {path}"))?;
         }