diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 3768457..cd7fc79 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -83,9 +83,16 @@ jobs:
       # No sudo: the runner's unit sets NoNewPrivileges=yes - systemctl
       # talks to PID1 over D-Bus, authorized by the polkit rule scoped
       # to deploy-runner + the app@* unit pattern.
+      # enable: the unit must come back after a host reboot (2026-08-30 a
+      # reboot left both portal instances down - deploys had only ever
+      # started them). Needs the manage-unit-files polkit grant; until
+      # that's on the host the enable is reported and skipped, never a
+      # failed deploy.
       - name: Activate and restart
         run: |
           ln -sfn "/srv/app/$INSTANCE/releases/$PORTAL_RELEASE" /srv/app/$INSTANCE/current
+          systemctl enable app@$INSTANCE.service \
+            || echo "::warning::could not enable app@$INSTANCE (polkit) - unit will not survive a reboot"
           systemctl restart app@$INSTANCE.service
 
       # www redirects to the apex for the same single-cookie-scope