diff --git a/README.md b/README.md
index 4375858..da9489b 100644
--- a/README.md
+++ b/README.md
@@ -217,7 +217,9 @@ external interface, in this order:
 Traffic from every other interface, including the internal one and the Docker bridges, is
 not affected. The rules cover IPv4 only.
 
-The `vpn-router-docker` service applies the rules after `docker.service` starts and removes
+`vpn-router-setup` starts after `docker.service`, so Docker is up when it looks for it; the
+ordering has no effect on a host without Docker. The `vpn-router-docker` service applies the
+rules after `docker.service` starts and removes
 them when Docker stops, so restarting Docker restores them. `systemctl restart
 vpn-router-setup` applies a changed configuration while Docker runs. With `docker.mode` set to
 `on`, the service fails when Docker is not installed or its daemon is not running; with
diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index 935f7a1..ec26e03 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,19 @@
+vpn-router (0.4.1-1) unstable; urgency=medium
+
+  * Fix the start of vpn-router-setup hanging on a host that runs Docker.
+    vpn-router-setup restarted vpn-router-docker and waited for it, but that
+    unit was ordered after vpn-router-setup, so each waited for the other,
+    the installation of the package never finished and vpn-router-web was
+    never enabled or started. vpn-router-docker is no longer ordered after
+    vpn-router-setup, so vpn-router-setup still waits for it and the Docker
+    rules are in place when it ends. The restart of vpn-router-web is queued
+    without waiting.
+  * Start vpn-router-setup after docker.service, so that Docker is up when
+    the setup looks for it and does not start in parallel with it. The
+    ordering applies only when Docker is installed.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 20:10:00 +0200
+
 vpn-router (0.4.0-1) unstable; urgency=medium
 
   * Add the vpn-router-web service, a small status web service that uses only
diff --git a/debian-package/debian/vpn-router.vpn-router-docker.service b/debian-package/debian/vpn-router.vpn-router-docker.service
index f94a416..b616bf1 100644
--- a/debian-package/debian/vpn-router.vpn-router-docker.service
+++ b/debian-package/debian/vpn-router.vpn-router-docker.service
@@ -1,7 +1,7 @@
 [Unit]
 Description=VPN Router rules for Docker published ports
 Documentation=file:/usr/share/doc/vpn-router/README.md
-After=docker.service vpn-router-setup.service
+After=docker.service
 PartOf=docker.service
 
 [Service]
diff --git a/debian-package/debian/vpn-router.vpn-router-setup.service b/debian-package/debian/vpn-router.vpn-router-setup.service
index 49a94a5..c82d7ab 100644
--- a/debian-package/debian/vpn-router.vpn-router-setup.service
+++ b/debian-package/debian/vpn-router.vpn-router-setup.service
@@ -2,7 +2,7 @@
 Description=VPN Router Setup
 Documentation=file:/usr/share/doc/vpn-router/README.md
 Wants=network-online.target
-After=network-online.target
+After=network-online.target docker.service
 
 [Service]
 Type=oneshot
diff --git a/debian-package/src/usr/lib/vpn-router/setup b/debian-package/src/usr/lib/vpn-router/setup
index 698aa8c..356de0a 100755
--- a/debian-package/src/usr/lib/vpn-router/setup
+++ b/debian-package/src/usr/lib/vpn-router/setup
@@ -318,7 +318,9 @@ def refresh_docker_rules():
     """Apply the new settings to the Docker rules while Docker is running.
 
     When Docker is not running, vpn-router-docker applies them after
-    docker.service starts.
+    docker.service starts. The restart is waited for, so the rules are in place
+    when this setup ends; vpn-router-docker is therefore not ordered after
+    vpn-router-setup.
     """
     if unit_is_active('docker.service'):
         run(['systemctl', 'restart', 'vpn-router-docker.service'], check=False)
@@ -332,7 +334,8 @@ def refresh_web(cfg, ctx):
     secrets masked and the facts resolved from the system from a file here, so
     that it needs nothing but the standard library and the configuration code.
     The file is readable by root only. The service ends quietly when
-    web.enabled is false.
+    web.enabled is false. The restart is queued, not waited for, because the
+    unit is ordered after vpn-router-setup.
     """
     masked = {
         section: {option: '********' if SECRET_OPTION.search(option) and value else value
@@ -363,7 +366,7 @@ def refresh_web(cfg, ctx):
             'remote_cidrs': ctx['remote_cidr_list'],
         },
     }) + '\n', encoding='utf-8')
-    run(['systemctl', 'restart', 'vpn-router-web.service'], check=False)
+    run(['systemctl', 'restart', '--no-block', 'vpn-router-web.service'], check=False)
 
 
 def main():