1 files changed, 12 insertions, 0 deletions
diff --git a/flake.nix b/flake.nix
index 0352aed..2029ffa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -468,6 +468,18 @@
               # isn't in the system profile on hosts that only run podman via
               # this service (farm1: "default OCI runtime 'crun' not found").
               path = [ config.nix.package pkgs.podman pkgs.crun pkgs.openssh (builtins.dirOf config.security.wrapperDir) ];
+              # NEVER restart this on a config switch. switch-to-configuration
+              # waits for a restarted unit's start job to *complete*, and for a
+              # Type=oneshot with TimeoutStartSec=infinity (below) that means the
+              # whole pass — hours on a backlog. It holds
+              # /run/nixos/switch-to-configuration.lock the entire time, so every
+              # later deploy dies with "Could not acquire lock", including the
+              # rollback. farm1 wedged this way on 2026-08-29: a switch sat 4h on
+              # a build pass, and because the deploy hook does farm1 first and
+              # exits on failure, farm2 went undeployed for three weeks.
+              # It's a timer-driven batch job, so restarting is pointless anyway —
+              # interrupting a pass buys nothing the next tick doesn't give us.
+              restartIfChanged = false;
               serviceConfig = {
                 Type = "oneshot";
                 User = cfg.user;