diff --git a/radiantwave-updater.nix b/radiantwave-updater.nix
index 008de79..968028b 100644
--- a/radiantwave-updater.nix
+++ b/radiantwave-updater.nix
@@ -52,6 +52,8 @@ in
         CURRENT=$(${pkgs.coreutils}/bin/readlink /var/lib/radiantwave/current 2>/dev/null || true)
 
         if [ -z "$NEW_PATH" ] || [ "$NEW_PATH" = "$CURRENT" ]; then
+          # Already current; make sure the running closure is GC-rooted.
+          ${pkgs.coreutils}/bin/ln -sfn "$CURRENT" /var/lib/radiantwave/.current-root 2>/dev/null || true
           echo "radiantwave-updater: already current (''${CURRENT})"
           exit 0
         fi
@@ -61,8 +63,11 @@ in
         # are signed by cache.nixos.org and Attic intentionally skips them to
         # avoid re-uploading the world. Fetch those from cache.nixos.org so
         # the whole closure resolves without ever building from source.
+        # --add-root pins the fetched closure so GC can't collect it while
+        # the swap below makes it live.
         echo "radiantwave-updater: acquiring ''${NEW_PATH}"
         ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \
+          --add-root /var/lib/radiantwave/.current-root \
           --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \
           --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || {
           echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}"