diff --git a/hive-c0re/src/auto_update.rs b/hive-c0re/src/auto_update.rs
index 9e13990a..99f8cbff 100644
--- a/hive-c0re/src/auto_update.rs
+++ b/hive-c0re/src/auto_update.rs
@@ -167,7 +167,8 @@ pub async fn rebuild_agent(
 /// Auto-create the manager container on startup if it isn't already there.
 /// hive-c0re manages the manager end-to-end: operators no longer declare
 /// `containers.h-ruth` in their host NixOS config. Bypasses the approval
-/// queue — manager is required infrastructure. Idempotent.
+/// queue — the root/manager is auto-managed by default (an operator opt-out
+/// is a separate host setting). Idempotent.
 pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
     let existing = lifecycle::list().await.unwrap_or_default();
     let current_rev = current_flake_rev(&coord.hyperhive_flake);
@@ -195,6 +196,20 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
         } else {
             tracing::debug!("manager container already present");
         }
+        // hive-c0re auto-manages the root/manager by default, so a
+        // present-but-stopped root (e.g. a first-start failure on a fresh
+        // install) is brought back up here: the startup sweep's rebuild only
+        // restarts a container that was already running, so without this it
+        // stays down until a manual `nixos-container start`. The sub-agent
+        // `was_running` guard is intentionally left untouched. (An operator
+        // opt-out of this whole auto-management is tracked as a separate
+        // host setting.)
+        if !lifecycle::is_running(MANAGER_NAME).await {
+            tracing::info!("manager container present but not running — starting");
+            if let Err(e) = lifecycle::start(MANAGER_NAME).await {
+                tracing::warn!(error = ?e, "manager start failed");
+            }
+        }
         return Ok(());
     }
     tracing::info!("manager container missing — spawning");