diff --git a/services/hydra/default.nix b/services/hydra/default.nix
index 685bc98..dec68b0 100644
--- a/services/hydra/default.nix
+++ b/services/hydra/default.nix
@@ -128,8 +128,11 @@ in {
       '';
     };
 
-    systemd.services.hydra-queue-runner.serviceConfig.EnvironmentFile =
-      config.age.secrets.hydra-s3-credentials.path;
+    systemd.services.hydra-queue-runner = {
+      # FIXME: should probably be set in the upstream Hydra module?
+      wants = [ "network-online.target" ];
+      serviceConfig.EnvironmentFile = config.age.secrets.hydra-s3-credentials.path;
+    };
 
     services.nginx = {
       enable = true;