diff --git a/ansible/roles/woodpecker-agent/handlers/main.yml b/ansible/roles/woodpecker-agent/handlers/main.yml
index 9e56b340..7117ad73 100644
--- a/ansible/roles/woodpecker-agent/handlers/main.yml
+++ b/ansible/roles/woodpecker-agent/handlers/main.yml
@@ -10,8 +10,11 @@
       systemctl restart docker
   changed_when: true
 
+# Also deferred: the agent restarting itself would interrupt the very
+# pipeline running this deploy. Reload the unit now, restart on a timer.
 - name: Restart woodpecker-agent
-  systemd:
-    name: woodpecker-agent
-    state: restarted
-    daemon_reload: yes
+  ansible.builtin.command:
+    cmd: >-
+      systemd-run --on-active=20s --timer-property=AccuracySec=100ms
+      sh -c "systemctl daemon-reload && systemctl restart woodpecker-agent"
+  changed_when: true
diff --git a/ansible/roles/woodpecker-agent/templates/agent.env.j2 b/ansible/roles/woodpecker-agent/templates/agent.env.j2
index 0a34e965..06cbc8b3 100644
--- a/ansible/roles/woodpecker-agent/templates/agent.env.j2
+++ b/ansible/roles/woodpecker-agent/templates/agent.env.j2
@@ -3,3 +3,6 @@ WOODPECKER_AGENT_SECRET={{ woodpecker_grpc_secret }}
 WOODPECKER_MAX_WORKFLOWS={{ woodpecker_max_workflows }}
 WOODPECKER_BACKEND=docker
 WOODPECKER_HOSTNAME={{ inventory_hostname }}
+# Create pipeline-step networks with IPv6 so steps can reach v6-only hosts
+# (pairs with the Docker daemon.json ipv6/ip6tables config).
+WOODPECKER_BACKEND_DOCKER_ENABLE_IPV6=true