diff --git a/scripts/t3-provision-users.sh b/scripts/t3-provision-users.sh
index 33edf3fd..737bfe4d 100644
--- a/scripts/t3-provision-users.sh
+++ b/scripts/t3-provision-users.sh
@@ -159,6 +159,10 @@ while IFS=$'\t' read -r os_user port; do
   id "$os_user" >/dev/null 2>&1 && run systemctl enable --now "t3-serve@$os_user.service" >/dev/null 2>&1 || true
 done < <(jq -r '.ports | to_entries[] | [.key, .value] | @tsv' "$desired_file")
 
+# 5b) machine-wide (once, not per-user): keep the t3 nightly auto-updater enabled so it
+#     self-heals hourly — a `disabled` timer silently freezes every instance on an old build.
+run systemctl enable --now t3-autoupdate.timer >/dev/null 2>&1 || true
+
 # 6) regenerate /etc/ttyd-user-map + dispatch.json from the desired state (SSoT:
 #    a roster entry removed here DISAPPEARS, which is what the offboarding cut relies on)
 if [[ "$DRY_RUN" == 1 ]]; then