diff --git a/Cargo.lock b/Cargo.lock
index 91e2f37..fc712ae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "0.1.15"
+version = "0.1.16"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index aebaf15..5da60d2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "0.1.15"
+version = "0.1.16"
 edition = "2024"
 license = "MIT"
 
diff --git a/install.sh b/install.sh
index 9db9f50..d0367b9 100755
--- a/install.sh
+++ b/install.sh
@@ -426,7 +426,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=$bindir/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
 
diff --git a/packaging/systemd/dosh-server.service b/packaging/systemd/dosh-server.service
index 7756f26..f34dd10 100644
--- a/packaging/systemd/dosh-server.service
+++ b/packaging/systemd/dosh-server.service
@@ -6,7 +6,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=%h/.local/bin/dosh-server serve
-Restart=on-failure
+Restart=always
 RestartSec=1
 KillMode=process
 
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index 084a66c..7239807 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -25,6 +25,10 @@ fn systemd_service_does_not_sandbox_remote_shells() {
     let install = include_str!("../install.sh");
     for raw in [service, install] {
         assert!(raw.contains("KillMode=process"));
+        assert!(
+            raw.contains("Restart=always"),
+            "dosh-server should come back after accidental SIGTERM while preserving child shells"
+        );
         for directive in [
             "NoNewPrivileges=",
             "PrivateTmp=",