diff --git a/firewall.sh b/firewall.sh
index 98073e0..9cb8e05 100644
--- a/firewall.sh
+++ b/firewall.sh
@@ -123,7 +123,8 @@ UNIT
   done
   systemctl daemon-reload
   systemctl enable platform-firewall.service >/dev/null
-  systemctl restart platform-firewall.service
+  # Reload an active gate: restarting a Required unit stops Docker/Tailscale.
+  systemctl reload-or-restart platform-firewall.service
 }
 check_ssh_transaction() {
   local transaction=$1 digest=$2 ssh_state=${3:-/var/lib/platform-bootstrap/ssh}