diff --git a/update_and_deploy_fips.sh b/update_and_deploy_fips.sh
index e1bc39c..9efda9d 100755
--- a/update_and_deploy_fips.sh
+++ b/update_and_deploy_fips.sh
@@ -184,6 +184,53 @@ ask_yes_no() {
   done
 }
 
+restart_unit_with_diagnostics() {
+  local unit="$1"
+  local required="${2:-yes}"
+  local timeout_seconds="${SERVICE_RESTART_TIMEOUT_SECONDS:-45}"
+  local journal_lines="${SERVICE_JOURNAL_LINES:-120}"
+  local output rc
+
+  if command -v timeout >/dev/null 2>&1; then
+    if ! output="$(sudo timeout "${timeout_seconds}" systemctl restart "${unit}" 2>&1)"; then
+      rc=$?
+      echo "Error: failed to restart ${unit} (exit ${rc})." >&2
+      if [[ ${rc} -eq 124 ]]; then
+        echo "Hint: restart timed out after ${timeout_seconds}s." >&2
+      fi
+      [[ -n "${output}" ]] && printf '%s\n' "${output}" >&2
+      echo "--- systemctl status ${unit} ---" >&2
+      sudo systemctl status "${unit}" --no-pager >&2 || true
+      echo "--- journalctl -u ${unit} (last ${journal_lines} lines) ---" >&2
+      sudo journalctl -u "${unit}" -n "${journal_lines}" --no-pager >&2 || true
+      [[ "${required}" == "yes" ]] && return 1
+      return 0
+    fi
+  else
+    if ! output="$(sudo systemctl restart "${unit}" 2>&1)"; then
+      rc=$?
+      echo "Error: failed to restart ${unit} (exit ${rc})." >&2
+      [[ -n "${output}" ]] && printf '%s\n' "${output}" >&2
+      echo "--- systemctl status ${unit} ---" >&2
+      sudo systemctl status "${unit}" --no-pager >&2 || true
+      echo "--- journalctl -u ${unit} (last ${journal_lines} lines) ---" >&2
+      sudo journalctl -u "${unit}" -n "${journal_lines}" --no-pager >&2 || true
+      [[ "${required}" == "yes" ]] && return 1
+      return 0
+    fi
+  fi
+
+  if ! sudo systemctl is-active --quiet "${unit}"; then
+    echo "Error: ${unit} is not active after restart." >&2
+    echo "--- systemctl status ${unit} ---" >&2
+    sudo systemctl status "${unit}" --no-pager >&2 || true
+    echo "--- journalctl -u ${unit} (last ${journal_lines} lines) ---" >&2
+    sudo journalctl -u "${unit}" -n "${journal_lines}" --no-pager >&2 || true
+    [[ "${required}" == "yes" ]] && return 1
+    return 0
+  fi
+}
+
 ensure_build_toolchain
 ensure_tun_ready
 
@@ -317,7 +364,7 @@ function indent_of(s,   i,c) {
 
   if (in_udp && indent <= udp_indent && line !~ /^[[:space:]]*$/ && line !~ /^[[:space:]]*#/) {
     if (!udp_has_mtu) {
-      print sprintf("%*smtu: 1280", udp_indent + 3, "")
+      print sprintf("%*smtu: 1280", udp_indent + 2, "")
       udp_has_mtu = 1
     }
     in_udp = 0
@@ -347,7 +394,7 @@ function indent_of(s,   i,c) {
 }
 END {
   if (in_udp && !udp_has_mtu) {
-    print sprintf("%*smtu: 1280", udp_indent + 3, "")
+    print sprintf("%*smtu: 1280", udp_indent + 2, "")
   }
 }
 ' "${CONFIG_FILE}" > "${TMP_CONFIG}"
@@ -402,8 +449,8 @@ sudo ip -6 route del fd00::/8 >/dev/null 2>&1 || true
 if [[ "${START_SERVICE_NOW}" == "yes" ]]; then
   echo "==> Starting/restarting FIPS services"
   sudo systemctl daemon-reload
-  sudo systemctl restart fips.service
-  sudo systemctl restart fips-dns.service || true
+  restart_unit_with_diagnostics "fips.service" "yes"
+  restart_unit_with_diagnostics "fips-dns.service" "no"
 
   echo "==> Running post-deploy health check"
   if [[ -x "${SCRIPT_DIR}/test_fips.sh" ]]; then