diff --git a/install.sh b/install.sh
index 9d42c0d..68688b5 100755
--- a/install.sh
+++ b/install.sh
@@ -348,6 +348,14 @@ EOF
     log "NAT routing service installed"
 
     # Start/enable dnsmasq
+    # Add restart policy for containers (interface may not be ready on first boot)
+    mkdir -p /etc/systemd/system/dnsmasq.service.d
+    cat > /etc/systemd/system/dnsmasq.service.d/restart.conf << 'EOF'
+[Service]
+Restart=on-failure
+RestartSec=5
+EOF
+    systemctl daemon-reload
     systemctl enable dnsmasq 2>/dev/null || true
     systemctl restart dnsmasq 2>/dev/null || service dnsmasq restart 2>/dev/null || true
     log "dnsmasq restarted"