diff --git a/deploy/update.sh b/deploy/update.sh
index 6f9fcb4..51d8a2f 100755
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -316,6 +316,15 @@ docker compose up -d
 # keep running the code from before the update.
 docker compose restart queue queue-provisioning scheduler reverb
 
+# AFTER the hub, always. Both VPN services live in the provisioning container's
+# network namespace, and a process holds the namespace it started in — so once
+# the hub is restarted they are listening inside one that no longer exists.
+# Nothing errors; connections to the tunnel address are simply refused, which
+# looks exactly like the gateway never having worked.
+if grep -qE '^COMPOSE_PROFILES=.*vpn' .env 2>/dev/null; then
+    docker compose --profile vpn restart vpn-dns vpn-gateway >/dev/null 2>&1 || true
+fi
+
 reconcile_vpn_readiness
 
 log "Leaving maintenance mode"