diff --git a/services/base.sh b/services/base.sh
index f06d1ec..ec5814a 100644
--- a/services/base.sh
+++ b/services/base.sh
@@ -31,7 +31,7 @@ install_base() {
     install_glow
 
     # ── Docker ───────────────────────────────────────────────────────────────
-    require_docker
+    require_docker || log_warning "Docker install failed — will retry after base setup"
 
     # ── OpenSSH server ───────────────────────────────────────────────────────
     _base_setup_ssh
diff --git a/setup.sh b/setup.sh
index ce2f0f1..da2667b 100755
--- a/setup.sh
+++ b/setup.sh
@@ -222,10 +222,13 @@ else
     fi
 
     run_service base
-    if ! command -v docker >/dev/null 2>&1; then
-        log_warning "Docker is not installed. Containerized services need it."
-        echo "  Install with:  curl -fsSL https://get.docker.com | sh"
-    fi
+fi
+
+# Always ensure Docker is present — base may have been installed before Docker
+# was added to it, or a previous install may have failed.
+if ! command -v docker &>/dev/null && ! [ -x /usr/bin/docker ]; then
+    log_info "Docker not found — installing now..."
+    require_docker
 fi
 
 # 3) Offer site defaults wizard if .config has no SITE_TZ yet (first run).