diff --git a/.gitignore b/.gitignore
index d5768ae3c..51824afb8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /tmp
 *~
 *.sw?
+/docs
diff --git a/classes/aziot.bbclass b/classes/aziot.bbclass
index 085f2e138..8efabf2ca 100644
--- a/classes/aziot.bbclass
+++ b/classes/aziot.bbclass
@@ -29,3 +29,10 @@ do_install:prepend() {
     install -d -m 0750 -g aziotks ${D}${sysconfdir}/aziot/keyd
     install -d -m 0700 -o aziotks -g aziotks ${D}${sysconfdir}/aziot/keyd/config.d
 }
+
+# a service skipped by its condition must not fail its socket through the
+# trigger limit: without the limit the socket stays listening, and the first
+# connect after the condition turns true activates the service
+aziot_disable_socket_trigger_limit() {
+    sed -i 's/^\[Socket\]$/[Socket]\nTriggerLimitIntervalSec=0/' "$1"
+}
diff --git a/dynamic-layers/virtualization/recipes-azure-iot/iotedge/aziot-edged/aziot-edged.inc b/dynamic-layers/virtualization/recipes-azure-iot/iotedge/aziot-edged/aziot-edged.inc
index 661bfaf09..a756b22a2 100644
--- a/dynamic-layers/virtualization/recipes-azure-iot/iotedge/aziot-edged/aziot-edged.inc
+++ b/dynamic-layers/virtualization/recipes-azure-iot/iotedge/aziot-edged/aziot-edged.inc
@@ -60,6 +60,8 @@ do_install () {
 
     install -m 0644 ${S}/edgelet/contrib/systemd/debian/aziot-edged.workload.socket  ${D}${systemd_system_unitdir}/aziot-edged.workload.socket
     install -m 0644 ${S}/edgelet/contrib/systemd/debian/aziot-edged.mgmt.socket  ${D}${systemd_system_unitdir}/aziot-edged.mgmt.socket
+    aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-edged.workload.socket
+    aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-edged.mgmt.socket
 }
 
 USERADD_PARAM:${PN} += " \
diff --git a/recipes-azure-iot/azure-identityd/aziot-identityd.inc b/recipes-azure-iot/azure-identityd/aziot-identityd.inc
index 93869f476..082bc43bd 100644
--- a/recipes-azure-iot/azure-identityd/aziot-identityd.inc
+++ b/recipes-azure-iot/azure-identityd/aziot-identityd.inc
@@ -131,6 +131,7 @@ do_install() {
     install -m 0644     ${S}/cert/aziot-certd/aziot-certd.socket.in ${D}${systemd_system_unitdir}/aziot-certd.socket
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-certd.service
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-certd.socket
+    aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-certd.socket
 
     # enable identity service to create cert "device-id" (e.g. for x509 dps provisioning)
     install -m 0600 -o aziotcs -g aziotcs ${WORKDIR}/iot-identity-service-certd.template.toml ${D}${sysconfdir}/aziot/certd/config.d/aziotid.toml
@@ -147,6 +148,7 @@ do_install() {
     install -m 0644     ${S}/identity/aziot-identityd/aziot-identityd.socket.in ${D}${systemd_system_unitdir}/aziot-identityd.socket
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-identityd.service
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-identityd.socket
+    aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-identityd.socket
 
     install -m 0644     ${S}/key/aziot-keyd/aziot-keyd.service.in ${D}${systemd_system_unitdir}/aziot-keyd.service
     sed -i \
@@ -159,6 +161,7 @@ do_install() {
     install -m 0644     ${S}/key/aziot-keyd/aziot-keyd.socket.in ${D}${systemd_system_unitdir}/aziot-keyd.socket
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-keyd.service
     fill_placeholders ${D}${systemd_system_unitdir}/aziot-keyd.socket
+    aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-keyd.socket
 
     if ${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'true', 'false', d)}; then
         install -m 0644     ${S}/tpm/aziot-tpmd/aziot-tpmd.service.in ${D}${systemd_system_unitdir}/aziot-tpmd.service
@@ -172,6 +175,7 @@ do_install() {
         install -m 0644     ${S}/tpm/aziot-tpmd/aziot-tpmd.socket.in ${D}${systemd_system_unitdir}/aziot-tpmd.socket
         fill_placeholders ${D}${systemd_system_unitdir}/aziot-tpmd.service
         fill_placeholders ${D}${systemd_system_unitdir}/aziot-tpmd.socket
+        aziot_disable_socket_trigger_limit ${D}${systemd_system_unitdir}/aziot-tpmd.socket
     fi
 
     # libaziot-key-openssl-engine-shared
@@ -187,8 +191,10 @@ do_install() {
     install -m 0644 ${WORKDIR}/aziot-identityd-precondition.service ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
     if ${@bb.utils.contains('DISTRO_FEATURES', 'iotedge', 'true', 'false', d)}; then
         sed -i "s/@@AZIOTCLI@@/iotedge/" ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
+        sed -i "s/@@STACK_UNITS@@/aziot-identityd.service aziot-edged.service/" ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
     else
         sed -i "s/@@AZIOTCLI@@/aziotctl/" ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
+        sed -i "s/@@STACK_UNITS@@/aziot-identityd.service/" ${D}${systemd_system_unitdir}/aziot-identityd-precondition.service
     fi
     install -m 0644 ${WORKDIR}/aziot-identityd-precondition.timer ${D}${systemd_system_unitdir}/aziot-identityd-precondition.timer
 }
diff --git a/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
index 71f33e96a..39e48d785 100644
--- a/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
+++ b/recipes-azure-iot/azure-identityd/aziot-identityd/aziot-identityd-precondition.service
@@ -26,6 +26,11 @@ StartLimitIntervalSec=120
 [Service]
 Type=oneshot
 ExecStart=@@AZIOTCLI@@ config apply
+# a run after boot only writes the config; bring the services up like the
+# boot transaction would. --no-block is required: this unit is ordered
+# Before= the started units, a blocking start would deadlock. On a normal
+# boot the request merges with the already queued jobs.
+ExecStartPost=-/bin/systemctl start --no-block @@STACK_UNITS@@
 Restart=on-failure
 RestartSec=5
 RemainAfterExit=true
diff --git a/recipes-azure-iot/iot-hub-device-update/iot-hub-device-update/deviceupdate-agent.service b/recipes-azure-iot/iot-hub-device-update/iot-hub-device-update/deviceupdate-agent.service
index 2664e7ece..626a248d0 100644
--- a/recipes-azure-iot/iot-hub-device-update/iot-hub-device-update/deviceupdate-agent.service
+++ b/recipes-azure-iot/iot-hub-device-update/iot-hub-device-update/deviceupdate-agent.service
@@ -5,14 +5,17 @@ Wants=network-online.target aziot-identityd.service
 
 ConditionPathExists=!/run/omnect-device-service/omnect_validate_update
 
-StartLimitBurst=10
-StartLimitIntervalSec=120
+# never park in 'failed': each restart also pulls identity up again via
+# Wants=, and a persistent loop is caught by the crash-loop check
+StartLimitIntervalSec=0
 
 [Service]
 Type=notify
 
 Restart=always
 RestartSec=5
+RestartSteps=5
+RestartMaxDelaySec=60
 
 User=adu
 Group=adu