diff --git a/hosts/xlab-gateway/dhcp.nix b/hosts/xlab-gateway/dhcp.nix
index 9426c1e..0a9e98b 100644
--- a/hosts/xlab-gateway/dhcp.nix
+++ b/hosts/xlab-gateway/dhcp.nix
@@ -119,9 +119,15 @@
   
   # The global network-online target is intentionally disabled on this router,
   # so wait for the actual LAN device and addresses before Kea opens sockets.
+  #
+  # Order against the device, never Requires= it. systemd propagates a device
+  # unit's stop to every unit requiring it, and nothing pulls a service back in
+  # when the device returns, so one recreation of bond.lan254 (netdev change,
+  # bond flap) would silently end DHCP until someone noticed. The ExecStartPre
+  # probe is the real gate: it waits up to 30s, so Restart=on-failure retries
+  # stay far below the start limit and recover on their own.
   systemd.services.kea-dhcp4-server = {
-    requires = [ lanDeviceUnit ];
-    wants = [ "kea-dhcp-ddns-server.service" ];
+    wants = [ lanDeviceUnit "kea-dhcp-ddns-server.service" ];
     after = [
       lanDeviceUnit
       "systemd-networkd.service"
@@ -207,8 +213,10 @@
     '';
   };
 
+  # Same reasoning as Kea: order against the LAN device, don't let its removal
+  # take radvd down for good. radvd carries Restart=always from the module.
   systemd.services.radvd = {
-    requires = [ lanDeviceUnit ];
+    wants = [ lanDeviceUnit ];
     after = [ lanDeviceUnit "systemd-networkd.service" ];
     serviceConfig.ExecStartPre = [ waitForLanAddresses ];
   };