diff --git a/packages/network-watchdog/default.nix b/packages/network-watchdog/default.nix
index f8f98a3..02b4e68 100644
--- a/packages/network-watchdog/default.nix
+++ b/packages/network-watchdog/default.nix
@@ -14,11 +14,11 @@
 # and the programs speak no health protocol, so we probe the real thing — is
 # the MainPID still holding a live (established, non-loopback) connection?
 #
-#   wait-online UNIT  block until a real address exists; used as ExecStartPre
+#   wait-online UNIT  block until a default route exists; used as ExecStartPre
 #                     so UNIT only starts once online. Also stamps the start
 #                     time so `check` leaves a freshly (re)started UNIT alone.
 #   check UNIT...     one tick, run by a 60s timer: restart every UNIT that is
-#                     active but not connected, at most once per 5 minutes.
+#                     active but not connected, at most once per 2 minutes.
 #
 # Wired up by the services.network-watchdog home-manager module.
 
@@ -29,9 +29,9 @@ writeShellScriptBin "network-watchdog" ''
 
   usage() { echo "usage: network-watchdog wait-online UNIT | check UNIT..." >&2; exit 64; }
 
-  # A global-scope address on a non-loopback interface — true for a LAN IP too,
-  # so this needs no server URL and works whether the server is local or remote.
-  network_up() { ${iproute2}/bin/ip -o addr show scope global up 2>/dev/null | ${gnugrep}/bin/grep -q .; }
+  # Online = a default route.  An address alone is not enough: wg0 and virtual
+  # bridges carry global-scope addresses whether or not there is a way out.
+  network_up() { { ${iproute2}/bin/ip -4 route show default; ${iproute2}/bin/ip -6 route show default; } 2>/dev/null | ${gnugrep}/bin/grep -q .; }
 
   # Healthy: MainPID owns an established socket to something other than loopback.
   connected() {
@@ -41,8 +41,8 @@ writeShellScriptBin "network-watchdog" ''
       | ${gnugrep}/bin/grep -qv -e '127\.0\.0\.1' -e '\[::1\]'
   }
 
-  # Stamped within the last 5 minutes: still connecting, or already restarted.
-  recently_started() { [ -n "$(${findutils}/bin/find "$stampdir/$1" -mmin -5 2>/dev/null)" ]; }
+  # Stamped within the last 2 minutes: still connecting, or already restarted.
+  recently_started() { [ -n "$(${findutils}/bin/find "$stampdir/$1" -mmin -2 2>/dev/null)" ]; }
 
   [ $# -ge 1 ] || usage
   cmd="$1"; shift