diff --git a/common/network/pia-vpn/vpn-container.nix b/common/network/pia-vpn/vpn-container.nix
index 0782e6c..b210918 100644
--- a/common/network/pia-vpn/vpn-container.nix
+++ b/common/network/pia-vpn/vpn-container.nix
@@ -52,7 +52,7 @@ in
 {
   config = mkIf cfg.enable {
     # Give the container more time to boot (pia-vpn-setup retries can delay readiness)
-    systemd.services."container@pia-vpn".serviceConfig.TimeoutStartSec = "180s";
+    systemd.services."container@pia-vpn".serviceConfig.TimeoutStartSec = mkForce "180s";
 
     containers.pia-vpn = {
       autoStart = true;