diff --git a/Dockerfile.agnos b/Dockerfile.agnos
index e5cbdcc..d234e93 100644
--- a/Dockerfile.agnos
+++ b/Dockerfile.agnos
@@ -113,7 +113,7 @@ RUN --mount=type=bind,source=userspace/root,target=/tmp/agnos/root \
     set -o pipefail && \
     tar -C /tmp/agnos/root --owner=0 --group=0 --mode=go-w -cf - . | tar -C / --no-overwrite-dir -xf -
 COPY ./userspace/root/home/$USERNAME/.config/ /root/.config
-RUN chown -R $USERNAME: /home/$USERNAME/.config
+RUN chown -R $USERNAME: /home/$USERNAME
 RUN touch -r /lib/systemd/systemd /etc/fstab
 
 COPY ./output/linux-headers/include/ /usr/include/
diff --git a/userspace/root/usr/comma/init.qcom.sh b/userspace/root/usr/comma/init.qcom.sh
index 0adde8a..7161ed0 100755
--- a/userspace/root/usr/comma/init.qcom.sh
+++ b/userspace/root/usr/comma/init.qcom.sh
@@ -2,5 +2,5 @@
 
 # don't restart whole SoC on subsystem crash
 for i in {0..7}; do
-  echo "related" | sudo tee /sys/bus/msm_subsys/devices/subsys${i}/restart_level
+  echo "related" > /sys/bus/msm_subsys/devices/subsys${i}/restart_level
 done
diff --git a/userspace/root/usr/comma/set_ssh.sh b/userspace/root/usr/comma/set_ssh.sh
index eb77e97..307d0ad 100755
--- a/userspace/root/usr/comma/set_ssh.sh
+++ b/userspace/root/usr/comma/set_ssh.sh
@@ -6,5 +6,5 @@ if [ -f "$SSH_PARAM" ] && [ "$(< $SSH_PARAM)" == "1" ]; then
   systemctl start ssh
 else
   echo "Disabling SSH"
-  systemctl stop ssh
+  systemctl stop ssh.socket ssh
 fi
diff --git a/userspace/root/usr/comma/wifi.sh b/userspace/root/usr/comma/wifi.sh
index e871464..36aee8b 100755
--- a/userspace/root/usr/comma/wifi.sh
+++ b/userspace/root/usr/comma/wifi.sh
@@ -44,7 +44,11 @@ boot wlan /sys/kernel/boot_wlan/boot_wlan
   # https://github.com/commaai/agnos-kernel-sdm845/blob/8b0e4d289b246a5cc1b0484b25a3f9f8d4772544/drivers/soc/qcom/subsystem_restart.c#L1215-L1251
   (
     echo "modem: booting"
-    exec 3< /dev/subsys_modem && echo "modem: booted" || echo "modem: boot failed"
+    until exec 3< /dev/subsys_modem; do
+      echo "modem: boot failed, retrying"
+      sleep 1
+    done
+    echo "modem: booted"
     exec sleep infinity
   ) &
   daemon /usr/bin/pdmappersvc
diff --git a/userspace/root/usr/lib/systemd/system/init-qcom.service b/userspace/root/usr/lib/systemd/system/init-qcom.service
index 430fe95..6a65417 100644
--- a/userspace/root/usr/lib/systemd/system/init-qcom.service
+++ b/userspace/root/usr/lib/systemd/system/init-qcom.service
@@ -1,6 +1,8 @@
 [Unit]
 Description=QCOM init
 After=sysinit.target
+# set the restart levels before any subsystem boots
+Before=wifi.service sound.service cdsp.service
 
 [Service]
 Type=oneshot
diff --git a/userspace/root/usr/lib/systemd/system/magic.service b/userspace/root/usr/lib/systemd/system/magic.service
index 4136749..6782aeb 100644
--- a/userspace/root/usr/lib/systemd/system/magic.service
+++ b/userspace/root/usr/lib/systemd/system/magic.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=Magic
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
@@ -13,6 +14,9 @@ ExecStartPre=/bin/bash -c "echo 0 > /data/misc/display/sdm_dbg_cfg.txt || true"
 ExecStartPre=/bin/bash -c "echo 0 > /data/misc/display/gbm_dbg_cfg.txt || true"
 
 ExecStart=/bin/bash -c "source /etc/profile && /usr/local/venv/bin/python -u /usr/comma/magic.py"
+# raylib exits if the touchscreen or backlight isn't accessible yet, e.g. before udev sets their permissions
+Restart=on-failure
+RestartSec=1
 
 [Install]
 WantedBy=multi-user.target
diff --git a/userspace/root/usr/lib/systemd/system/serial-hostname.service b/userspace/root/usr/lib/systemd/system/serial-hostname.service
index 29f309d..22c7f9c 100644
--- a/userspace/root/usr/lib/systemd/system/serial-hostname.service
+++ b/userspace/root/usr/lib/systemd/system/serial-hostname.service
@@ -1,7 +1,8 @@
 [Unit]
 Description=Sets the hostname to the device's serial number
 After=basic.target
-Before=network.target
+# NetworkManager sends the hostname in DHCP requests
+Before=network.target NetworkManager.service
 
 [Service]
 User=root
diff --git a/userspace/root/usr/sbin/abctl b/userspace/root/usr/sbin/abctl
index 712cf94..d2ab66a 100755
--- a/userspace/root/usr/sbin/abctl
+++ b/userspace/root/usr/sbin/abctl
@@ -73,11 +73,17 @@ class GPT:
         pass
     if not arrays:
       raise ValueError(f'{path}: neither GPT copy is valid')
+    source = 1 if 1 in arrays else self.last
+    template = self.headers[source]
+    # Flashing only writes the primary, so a stale backup can disagree with it; rebuild it.
+    other = self.last if source == 1 else 1
+    if other in self.headers and (self.headers[other][40:72] != template[40:72] or
+                                  self.headers[other][80:88] != template[80:88]):
+      del self.headers[other]
+      arrays.pop(other, None)
     self.valid_copies = set(arrays)
     self.arrays = arrays
-    source = 1 if 1 in arrays else self.last
     self.entries = bytearray(arrays[source])
-    template = self.headers[source]
     self.entry_size = struct.unpack_from('<I', template, 84)[0]
     # Preserve the entry-array location in every valid header.
     # When rebuilding a header, reserve at least 16 KiB for the entry-array, matching ABL.
diff --git a/userspace/services.sh b/userspace/services.sh
index bcc0b40..5c20050 100755
--- a/userspace/services.sh
+++ b/userspace/services.sh
@@ -27,8 +27,8 @@ systemctl enable avahi-daemon
 systemctl enable avahi-ssh-publish.service
 systemctl enable screen_calibration.service
 
-# Disable SSH by default
-systemctl disable ssh
+# Disable SSH by default, ssh-param-watcher starts it
+systemctl disable ssh ssh.socket
 
 # Disable all useless systemctl services
 systemctl disable apt-daily-upgrade.service