diff --git a/app/Provisioning/Steps/Host/ConfigureWireguard.php b/app/Provisioning/Steps/Host/ConfigureWireguard.php
index 959aa83..304bdb9 100644
--- a/app/Provisioning/Steps/Host/ConfigureWireguard.php
+++ b/app/Provisioning/Steps/Host/ConfigureWireguard.php
@@ -63,14 +63,15 @@ class ConfigureWireguard extends HostStep
 
         $this->hub->addPeer($publicKey, $wgIp);
 
-        // Verify the tunnel BEFORE recording the peer as provisioned. If the
-        // handshake isn't up we retry and re-run the full setup next time (no
-        // wg_peer resource yet), instead of skipping a broken configuration.
+        // Store the pubkey now (so removal can always clean up the hub peer), but
+        // record the wg_peer resource only AFTER the handshake verifies — the
+        // idempotent short-circuit must not skip an un-verified configuration.
+        $host->update(['wg_pubkey' => $publicKey]);
+
         if ($this->verifyHandshake()->type !== StepResult::ADVANCE) {
             return StepResult::retry(15, 'WireGuard handshake not up yet');
         }
 
-        $host->update(['wg_pubkey' => $publicKey]);
         $this->recordResource($run, $host, 'wg_peer', $publicKey);
 
         return StepResult::advance();