diff --git a/deploy/ansible/roles/docker/tasks/main.yml b/deploy/ansible/roles/docker/tasks/main.yml
index 3a07b81..eefdec2 100644
--- a/deploy/ansible/roles/docker/tasks/main.yml
+++ b/deploy/ansible/roles/docker/tasks/main.yml
@@ -41,11 +41,14 @@
     mode: "0644"
   notify: Restart docker
 
+# daemon_reload picks up the LimitNOFILE override below if it is already on
+# disk; without it Docker cannot start once base lowers fs.nr_open.
 - name: Ensure Docker is enabled and running
   ansible.builtin.systemd:
     name: docker
     enabled: true
     state: started
+    daemon_reload: true
 
 - name: Configure Docker systemd override for unlimited file descriptors
   ansible.builtin.file:
diff --git a/deploy/ansible/roles/firewall/handlers/main.yml b/deploy/ansible/roles/firewall/handlers/main.yml
deleted file mode 100644
index c28484f..0000000
--- a/deploy/ansible/roles/firewall/handlers/main.yml
+++ /dev/null
@@ -1,4 +0,0 @@
----
-- name: Reload systemd
-  ansible.builtin.systemd:
-    daemon_reload: true
diff --git a/deploy/ansible/roles/firewall/tasks/main.yml b/deploy/ansible/roles/firewall/tasks/main.yml
index 52176a8..8efbf74 100644
--- a/deploy/ansible/roles/firewall/tasks/main.yml
+++ b/deploy/ansible/roles/firewall/tasks/main.yml
@@ -39,16 +39,15 @@
   loop:
     - ufw-cloudflare-sync.service
     - ufw-cloudflare-sync.timer
-  notify: Reload systemd
-
-- name: Apply systemd unit changes before enabling the timer
-  ansible.builtin.meta: flush_handlers
 
+# Reload here rather than via a handler: flushing handlers mid-play would also
+# run other roles' pending handlers (e.g. restarting Docker) out of order.
 - name: Enable daily Cloudflare IP sync
   ansible.builtin.systemd:
     name: ufw-cloudflare-sync.timer
     enabled: true
     state: started
+    daemon_reload: true
 
 - name: Sync Cloudflare IP ranges now
   ansible.builtin.command: /usr/local/sbin/ufw-cloudflare-sync