diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index c4a3608..8d60517 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,13 @@
+vpn-router (0.7.1-1) unstable; urgency=medium
+
+  fix: a failing user directory or token database no longer leaves the tunnels down.
+
+  * vpn-router-setup brings up strongSwan and WireGuard before it provisions
+    the user directory and the token database. A failure of either no
+    longer stops the other steps; setup reports it and fails at the end.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 25 Oct 2026 02:00:00 +0200
+
 vpn-router (0.7.0-1) unstable; urgency=medium
 
   feature: users sign in to the web service, and only members of admins manage the router.
diff --git a/debian-package/src/usr/lib/vpn-router/setup b/debian-package/src/usr/lib/vpn-router/setup
index c0c4a16..807e42b 100755
--- a/debian-package/src/usr/lib/vpn-router/setup
+++ b/debian-package/src/usr/lib/vpn-router/setup
@@ -20,8 +20,6 @@ import sys
 
 sys.path.insert(0, os.path.dirname(os.path.realpath(__file__)))
 
-import ldap
-
 import vpnrouter
 import vpnrouter_auth
 import vpnrouter_ldap
@@ -349,22 +347,26 @@ def manage_wireguard(ctx, changed):
 
 
 def manage_directory():
-    """Provision the user directory in slapd, whether or not a P2S system is configured."""
+    """Provision the user directory in slapd, whether or not a P2S system is configured; the problem, or ''."""
     if vpnrouter_ldap.ensure_services() or not unit_is_active('slapd'):
-        run(['systemctl', 'restart', 'slapd'])
+        result = run(['systemctl', 'restart', 'slapd'], check=False)
+        if result.returncode != 0:
+            return f'slapd cannot be restarted: {result.stderr.strip()}'
     try:
         vpnrouter_ldap.provision()
-    except ldap.LDAPError as exc:
-        fail(f'the user directory cannot be provisioned: {exc}')
+    except Exception as exc:
+        return f'the user directory cannot be provisioned: {exc!r}'
+    return ''
 
 
 def manage_tokens(cfg):
-    """Make the web service's signing key, and the database of its refresh tokens unless web.database names one."""
-    vpnrouter_auth.ensure_key()
+    """Make the web service's signing key, and the database of its refresh tokens unless web.database names one; the problem, or ''."""
     try:
+        vpnrouter_auth.ensure_key()
         vpnrouter_auth.provision(cfg)
-    except OSError as exc:
-        fail(f'the token database cannot be provisioned: {exc}')
+    except Exception as exc:
+        return f'the token database cannot be provisioned: {exc!r}'
+    return ''
 
 
 def manage_openvpn(ctx, changed):
@@ -473,10 +475,11 @@ def main():
     elif rules_changed:
         run(['ufw', 'reload'], check=False)
 
-    manage_directory()
-    manage_tokens(cfg)
     manage_strongswan(ctx, changed)
     manage_wireguard(ctx, changed)
+
+    # The tunnels are up before the directory and the tokens, whose problems end setup only after every other step.
+    problems = [problem for problem in (manage_directory(), manage_tokens(cfg)) if problem]
     manage_openvpn(ctx, changed)
 
     if 'resolved' in changed:
@@ -485,7 +488,9 @@ def main():
     run_platform_setup(cfg, ctx)
     refresh_docker_rules()
     refresh_web(cfg, ctx)
-    return 0
+    for problem in problems:
+        print(f'vpn-router: error: {problem}', file=sys.stderr)
+    return 1 if problems else 0
 
 
 if __name__ == '__main__':