diff --git a/modules/server/containers/default.nix b/modules/server/containers/default.nix
index 28c8487..23c9272 100644
--- a/modules/server/containers/default.nix
+++ b/modules/server/containers/default.nix
@@ -21,6 +21,17 @@ let
     (map (app: ({ name = app.name; envFile = [ ]; } // app.runtime.setup)) appsList);
   allCronsConfigs = concatRuntimeLists "cron";
   allVMConfigs = builtins.filter (app: app.runtime.vm != null) appsList;
+  containerUnitNames = map (name: "podman-${name}.service") (builtins.attrNames mergedContainers);
+  setupUnitNames = map (setup: "${setup.name}-setup.service") allSetupConfigs;
+  reconcileUnitNames = containerUnitNames ++ setupUnitNames;
+  reconcileUnits = lib.concatMapStringsSep " " lib.escapeShellArg reconcileUnitNames;
+  reconcileTrigger = pkgs.writeText "syscfg-containers-reconcile-trigger.json" (builtins.toJSON {
+    containers = mergedContainers;
+    setup = map (setup: {
+      inherit (setup) name trigger envFile;
+      script = toString setup.script;
+    }) allSetupConfigs;
+  });
   mkPathSetup = cfg:
     let
       effectiveCfg = {
@@ -62,12 +73,26 @@ in {
           '';
           startAt = "weekly";
         };
+        syscfg-containers-reconcile = {
+          description = "Queue OCI container restarts after configuration changes";
+          wantedBy = [ "multi-user.target" ];
+          restartTriggers = [ reconcileTrigger ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          script = ''
+            ${lib.optionalString (reconcileUnitNames != []) ''
+              ${pkgs.systemd}/bin/systemctl --no-block restart ${reconcileUnits}
+            ''}
+          '';
+        };
       } 
       // builtins.listToAttrs (
         map (name: {
           name = "podman-${name}";
-          value.serviceConfig.Type = lib.mkForce "exec";
-        }) (builtins.attrNames config.virtualisation.oci-containers.containers)
+          value.restartIfChanged = false;
+        }) (builtins.attrNames mergedContainers)
       )
       // mkNamedUnits (e: {
         name = "${e.name}-vm";
@@ -99,7 +124,7 @@ in {
           # wants = [ "podman-${e.name}-${e.trigger}.service" ];
           partOf = [ "podman-${e.name}-${e.trigger}.service" ];
           wantedBy = [ "multi-user.target" ];
-          restartTriggers = [ e.script ];
+          restartIfChanged = false;
           serviceConfig = {
             Type = "simple";
             Restart = "on-failure";