diff --git a/machines/vueko/services/murmur.nix b/machines/vueko/services/murmur.nix
index 0ea85f9..d5780ed 100644
--- a/machines/vueko/services/murmur.nix
+++ b/machines/vueko/services/murmur.nix
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2021-2022 Simon Bruder <simon@sbruder.de>
+# SPDX-FileCopyrightText: 2021-2024 Simon Bruder <simon@sbruder.de>
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -25,6 +25,8 @@
       channelname = ''[ \\-=\\w\\#\\[\\]\\{\\}\\(\\)\\@\\|]+'';
     };
   };
+  # upstream (out-of-tree) does not define this, but nixpkgs wants (🥁) it
+  systemd.services.murmur.wants = [ "network-online.target" ];
 
   services.nginx.virtualHosts."mumble.sbruder.de" = {
     enableACME = true;
diff --git a/modules/media-proxy.nix b/modules/media-proxy.nix
index 3c57e8a..bc323d4 100644
--- a/modules/media-proxy.nix
+++ b/modules/media-proxy.nix
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2020-2023 Simon Bruder <simon@sbruder.de>
+# SPDX-FileCopyrightText: 2020-2024 Simon Bruder <simon@sbruder.de>
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
@@ -23,6 +23,7 @@ in
 
     # otherwise name resolution fails
     systemd.services.nginx.after = [ "network-online.target" ];
+    systemd.services.nginx.wants = [ "network-online.target" ];
     services.nginx = {
       enable = true;
       commonHttpConfig = ''