diff --git a/install/user/first-run/enable-user-units.sh b/install/user/first-run/enable-user-units.sh
index 6a6a65d2..18b3a449 100755
--- a/install/user/first-run/enable-user-units.sh
+++ b/install/user/first-run/enable-user-units.sh
@@ -1,15 +1,17 @@
 #!/bin/bash
 
-# Enable the user systemd units we ship. Runs at first-run rather than at
-# finalize-user time because the user manager isn't live during the ISO
-# chroot — by first-run, the Hyprland/uwsm session is up and `systemctl
-# --user enable` writes the correct .wants symlinks based on each unit's
-# [Install]/WantedBy. ConditionPath* in the unit files keep the enabled
-# units inert on hardware they don't apply to.
+# Enable AND start the user systemd units we ship. Runs at first-run rather
+# than at finalize-user time because the user manager isn't live during the
+# ISO chroot — by first-run, the Hyprland/uwsm session is up and
+# `systemctl --user enable --now` both writes the correct .wants symlinks
+# (based on each unit's [Install]/WantedBy) and starts the services so the
+# first session has bluetooth pairing, sleep lock, etc. live immediately
+# instead of waiting for the next login. ConditionPath* in the unit files
+# keep the enabled units inert on hardware they don't apply to.
 
 set -euo pipefail
 
-systemctl --user enable \
+systemctl --user enable --now \
   bt-agent.service \
   omarchy-recover-internal-monitor.service \
   omarchy-sleep-lock.service