diff --git a/flake.lock b/flake.lock
index 98a6403..24e015e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -24,11 +24,11 @@
     "moonarch": {
       "flake": false,
       "locked": {
-        "lastModified": 1788955787,
-        "narHash": "sha256-VII5Od3i1YyHqIWJgDb2El58Xf2XgCdcnfRNzmz0ueg=",
+        "lastModified": 1788961983,
+        "narHash": "sha256-ndUyq3X3E5vVdUflbCxdd2c+CBlXcNgn0rc5qiovCUM=",
         "ref": "refs/heads/main",
-        "rev": "7a24cdb6ae1831ffe74c54f1bce1d3538147284f",
-        "revCount": 178,
+        "rev": "ba3745603cd01508669a70e56527e3d471a0d5f6",
+        "revCount": 179,
         "type": "git",
         "url": "https://gitea.moonarch.de/nevaforget/moonarch.git"
       },
diff --git a/modules/desktop.nix b/modules/desktop.nix
index e11087a..f1bf596 100644
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -305,6 +305,17 @@ in
     cliphist
     wl-clipboard
 
+    # The launcher's start prefix, and why the launcher needs one: Quickshell
+    # spawns applications as its own children, and a child inherits its
+    # parent's cgroup, so everything started from the launcher lands inside
+    # quickshell.service — which systemd kills whole on every restart of the
+    # unit (KillMode=control-group is the default). A crash of the bar took the
+    # open browser with it, and Librewolf counted each one as a crash until it
+    # stopped restoring the session at all. app2unit wraps systemd-run to put
+    # each application in its own transient app-*.scope, the same shape niri
+    # gives the windows it spawns itself.
+    app2unit
+
     # Display and wallpaper
     wlsunset
     nwg-look
diff --git a/modules/services.nix b/modules/services.nix
index 3020f67..4add3b2 100644
--- a/modules/services.nix
+++ b/modules/services.nix
@@ -159,6 +159,18 @@ in
     # this file. As a spawn-at-startup it inherited the session PATH; the unit
     # gets the same set rather than a list that goes stale on the next widget.
     path = [ config.system.path ];
+    # Restart=on-failure alone spun 32 times through a dead Wayland socket after
+    # a rebuild had sent niri SIGTERM: graphical-session-pre.target went down,
+    # graphical-session.target stayed up, so the unit was still wanted and every
+    # attempt died on "no Qt platform plugin could be initialized". Quickshell
+    # refuses a relaunch itself ("crashed within 10 seconds"), but systemd never
+    # reached the default limit of 5 starts per 10s at a 3s delay. Three tries
+    # per 30s ends it after ~9s. The window slides, so a single crash after a
+    # normal run still gets its restart — the point of running this as a unit.
+    unitConfig = {
+      StartLimitIntervalSec = 30;
+      StartLimitBurst = 3;
+    };
     serviceConfig = {
       Type = "simple";
       ExecStart = "${lib.getExe pkgs.quickshell} -c moonarch";