diff --git a/services/forgejo.nix b/services/forgejo.nix
index 0ffb849..9f9e218 100644
--- a/services/forgejo.nix
+++ b/services/forgejo.nix
@@ -25,8 +25,11 @@
   # Forgejo binds HTTP to 10.10.0.2 (the wg0 inner address). Without this
   # ordering, forgejo races wireguard at boot, fails to bind, and stays up
   # only on its all-interfaces SSH listener — leaving the web UI 502'd.
+  # nixpkgs 25.11 routes networking.wireguard.interfaces through
+  # systemd-networkd, so the gate is network-online.target (which pulls in
+  # systemd-networkd-wait-online.service) rather than wireguard-wg0.service.
   systemd.services.forgejo = {
-    after = [ "wireguard-wg0.service" ];
-    requires = [ "wireguard-wg0.service" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
   };
 }