diff --git a/packaging/debian/postinst b/packaging/debian/postinst
index 5d4e2b5..6baebfc 100755
--- a/packaging/debian/postinst
+++ b/packaging/debian/postinst
@@ -83,9 +83,23 @@ systemctl start ekklesia-classroom-update.timer || true
 # leaves dpkg half-configured. Every OTA reboots, so waiting for the next
 # boot costs nothing and cannot corrupt anything.
 #
-# A failure there must never fail this installation.
+# Provisioning is still enabled at boot so machines that were offline or
+# interrupted get another chance automatically.
 systemctl enable ekklesia-classroom-provision.service || true
 
+# Also schedule provisioning after this package installation completes.
+# Do not start it synchronously from postinst: dpkg/apt still owns its locks.
+# A short delayed systemd job lets the outer apt transaction finish first.
+#
+# If an OTA reboot happens before this fires, the normal enabled boot service
+# handles provisioning on the next boot instead.
+systemd-run \
+    --unit=ekklesia-classroom-provision-after-install \
+    --on-active=15s \
+    --property=Type=oneshot \
+    /bin/systemctl start ekklesia-classroom-provision.service \
+    >/dev/null 2>&1 || true
+
 # Gives Chrome a chance to close properly on reboot, so its profile is
 # not marked as crashed. Best effort: it must never hold a shutdown up.
 systemctl enable ekklesia-classroom-shutdown.service || true