diff --git a/install/config/enable-services.sh b/install/config/enable-services.sh
index 9cb6d924..fba0679d 100644
--- a/install/config/enable-services.sh
+++ b/install/config/enable-services.sh
@@ -1,12 +1,17 @@
-# Central place for unconditional, safe-to-start-now service enables.
-# Services that should NOT be started during install (sddm, ufw) live in
-# their own scripts. Hardware-gated services (t2fanrd, intel_lpmd,
-# thermald, omarchy-nvme-suspend-fix) also live with their detection.
-chrootable_systemctl_enable bluetooth.service
-chrootable_systemctl_enable cups.service
-chrootable_systemctl_enable cups-browsed.service
-chrootable_systemctl_enable avahi-daemon.service
-chrootable_systemctl_enable docker.socket
-chrootable_systemctl_enable iwd.service
-chrootable_systemctl_enable linux-modules-cleanup.service
-chrootable_systemctl_enable power-profiles-daemon.service
+# Central place for unconditional service enables. Services that should NOT
+# be started during install (sddm, ufw) live in their own scripts. Hardware-
+# gated services (t2fanrd, intel_lpmd, thermald, omarchy-nvme-suspend-fix)
+# also live with their detection.
+#
+# Two variants:
+#   chrootable_systemctl_enable      -> enable + start now (safe to start)
+#   chrootable_systemctl_enable_only -> enable only (don't risk starting during
+#                                       install)
+chrootable_systemctl_enable      bluetooth.service
+chrootable_systemctl_enable      cups.service
+chrootable_systemctl_enable      cups-browsed.service
+chrootable_systemctl_enable      avahi-daemon.service
+chrootable_systemctl_enable      linux-modules-cleanup.service
+chrootable_systemctl_enable_only docker.socket
+chrootable_systemctl_enable_only iwd.service
+chrootable_systemctl_enable_only power-profiles-daemon.service
diff --git a/install/helpers/chroot.sh b/install/helpers/chroot.sh
index b9541972..1a1b2cd2 100644
--- a/install/helpers/chroot.sh
+++ b/install/helpers/chroot.sh
@@ -7,5 +7,14 @@ chrootable_systemctl_enable() {
   fi
 }
 
-# Export the function so it's available in subshells
+# Like chrootable_systemctl_enable but never passes --now, so the service is
+# only enabled for the next boot. Use for services that are either already
+# running (and re-starting would interrupt the install — iwd) or that shouldn't
+# auto-start during install (docker, power-profiles-daemon).
+chrootable_systemctl_enable_only() {
+  sudo systemctl enable $1
+}
+
+# Export the functions so they're available in subshells
 export -f chrootable_systemctl_enable
+export -f chrootable_systemctl_enable_only