diff --git a/plugin/netbird.plg b/plugin/netbird.plg
index b27c348..afeb487 100644
--- a/plugin/netbird.plg
+++ b/plugin/netbird.plg
@@ -125,9 +125,10 @@ NEOF
     echo "  wrote $NEC with include_interfaces=\"wt0\""
 fi
 
-# Start the daemon, then reload nginx as soon as wt0 appears (so the WebGUI
-# binds to the NetBird IP and is reachable from other peers).
-/usr/local/emhttp/plugins/netbird/restart.sh
+# Start the daemon synchronously (waits for the socket), then reload nginx as
+# soon as wt0 appears (so the WebGUI binds to the NetBird IP and is reachable
+# from other peers).
+/etc/rc.d/rc.netbird start
 (
     for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
         if ip -4 addr show wt0 >/dev/null 2>&1; then
diff --git a/src/usr/local/emhttp/plugins/netbird/include/action.php b/src/usr/local/emhttp/plugins/netbird/include/action.php
index a716b8d..755b9f4 100644
--- a/src/usr/local/emhttp/plugins/netbird/include/action.php
+++ b/src/usr/local/emhttp/plugins/netbird/include/action.php
@@ -56,6 +56,15 @@ function nb_up_args(array $cfg): array
 
 switch ($action) {
     case 'up':
+        // Ensure the daemon is up (and its socket exists) before connecting,
+        // so a fresh install can connect from the GUI without a manual start.
+        if (!Netbird\daemonRunning() || !file_exists('/var/run/netbird.sock')) {
+            exec('/etc/rc.d/rc.netbird start > /dev/null 2>&1');
+            for ($i = 0; $i < 20; $i++) {
+                if (file_exists('/var/run/netbird.sock')) { break; }
+                usleep(500000);
+            }
+        }
         [$rc, $out] = Netbird\nb(nb_up_args($cfg));
         echo json_encode([
             'type'    => $rc === 0 ? 'success' : 'error',
diff --git a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
index 411c23d..275a814 100644
--- a/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
+++ b/src/usr/local/emhttp/plugins/netbird/scripts/apply.sh
@@ -19,7 +19,12 @@ fi
 
 log "Applying settings; restarting daemon."
 /etc/rc.d/rc.netbird restart
-sleep 2
+
+# Wait for the daemon socket before attempting login.
+for _ in $(seq 1 20); do
+    [ -S /var/run/netbird.sock ] && break
+    sleep 0.5
+done
 
 # If a setup key is provided, attempt non-interactive login on apply.
 if [ -n "$SETUP_KEY" ]; then
@@ -27,7 +32,13 @@ if [ -n "$SETUP_KEY" ]; then
     [ -n "$MANAGEMENT_URL" ] && UP_ARGS="$UP_ARGS --management-url $MANAGEMENT_URL"
     [ -n "$HOSTNAME" ]       && UP_ARGS="$UP_ARGS --hostname $HOSTNAME"
     [ -n "$PRESHARED_KEY" ]  && UP_ARGS="$UP_ARGS --preshared-key $PRESHARED_KEY"
-    log "Running: netbird $UP_ARGS"
-    /usr/local/sbin/netbird $UP_ARGS >>/var/log/netbird-utils.log 2>&1 || \
-        log "netbird up returned non-zero (this is normal if already connected)."
+    log "Running: netbird up (--setup-key ***)"
+    OUT=$(/usr/local/sbin/netbird $UP_ARGS 2>&1)
+    RC=$?
+    echo "$OUT" >> /var/log/netbird-utils.log
+    if [ "$RC" -ne 0 ]; then
+        log "netbird up failed (rc=$RC): $OUT"
+    else
+        log "netbird up succeeded."
+    fi
 fi
diff --git a/src/usr/local/etc/rc.d/rc.netbird b/src/usr/local/etc/rc.d/rc.netbird
index d892913..f2a7ec9 100644
--- a/src/usr/local/etc/rc.d/rc.netbird
+++ b/src/usr/local/etc/rc.d/rc.netbird
@@ -48,6 +48,17 @@ start_netbird() {
         --log-file "$LOGFILE" \
         $EXTRA_ARGS >>"$LOGFILE" 2>&1 &
     echo $! > "$PIDFILE"
+
+    # Wait for the daemon socket so callers (netbird up, apply) don't race startup.
+    for _ in $(seq 1 20); do
+        [ -S /var/run/netbird.sock ] && break
+        sleep 0.5
+    done
+    if [ -S /var/run/netbird.sock ]; then
+        log "NetBird daemon socket is up."
+    else
+        log "WARNING: netbird.sock did not appear within 10s; check $LOGFILE."
+    fi
 }
 
 stop_netbird() {