diff --git a/crates/heph/src/service.rs b/crates/heph/src/service.rs
index 6015a3d..fc642a7 100644
--- a/crates/heph/src/service.rs
+++ b/crates/heph/src/service.rs
@@ -168,7 +168,8 @@ fn systemd_unit(hephd: &Path, db: &Path, socket: &Path) -> String {
          \n\
          [Service]\n\
          ExecStart={hephd} --mode local --db {db} --socket {socket}\n\
-         Restart=on-failure\n\
+         Restart=always\n\
+         RestartSec=1\n\
          \n\
          [Install]\n\
          WantedBy=default.target\n",
@@ -400,7 +401,11 @@ mod tests {
              --db /home/e/.local/share/heph/heph.db \
              --socket /run/user/1000/heph/hephd.sock"
         ));
-        assert!(unit.contains("Restart=on-failure"));
+        // Restart=always (not on-failure) so a clean exit (code 0) — what
+        // self-update does to hand off to the new binary — is respawned too.
+        assert!(unit.contains("Restart=always"));
+        assert!(!unit.contains("Restart=on-failure"));
+        assert!(unit.contains("RestartSec="));
         assert!(unit.contains("WantedBy=default.target"));
     }
 
diff --git a/docs/how-to/run-the-daemon.md b/docs/how-to/run-the-daemon.md
index 8ada221..658a664 100644
--- a/docs/how-to/run-the-daemon.md
+++ b/docs/how-to/run-the-daemon.md
@@ -28,9 +28,14 @@ when it's already stopped is fine.
   `~/Library/LaunchAgents/org.hephaestus.hephd.plist`, with `RunAtLoad` +
   `KeepAlive` (starts at login, restarts if it crashes).
 - **Linux** — a **systemd user service** (`heph.service`) at
-  `~/.config/systemd/user/heph.service`, with `Restart=on-failure`, enabled for
+  `~/.config/systemd/user/heph.service`, with `Restart=always`, enabled for
   login.
 
+> **Upgrading from an older install:** earlier units used `Restart=on-failure`,
+> which does **not** respawn after a clean exit — so opt-in self-update (which
+> exits cleanly to hand off to the new binary) wouldn't come back on Linux. Run
+> `heph daemon restart` once (it regenerates the unit) to pick up `Restart=always`.
+
 Either way it runs `hephd --mode local` against the default store
 (`~/.local/share/heph/heph.db`) and socket, with logs at
 `~/.local/share/heph/hephd.log`.