diff --git a/Cargo.lock b/Cargo.lock
index 1700c27..62199ae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -476,7 +476,7 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "c0mpute-api"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "c0mpute-proto",
@@ -491,7 +491,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-bench"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "blake3",
@@ -502,7 +502,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-cli"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "axum",
@@ -532,7 +532,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-core"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-doctor"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "serde",
@@ -578,7 +578,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-envelope"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "blake3",
  "bs58",
@@ -591,7 +591,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-gateway"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "axum",
@@ -613,7 +613,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-market"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "c0mpute-envelope",
  "serde",
@@ -623,7 +623,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-net"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -640,7 +640,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-placement"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -661,7 +661,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-proto"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "blake3",
  "hex",
@@ -673,7 +673,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-secure-chat"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -696,7 +696,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-store"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "blake3",
@@ -714,7 +714,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-transcode"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "c0mpute-proto",
@@ -726,7 +726,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-update"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "hex",
@@ -740,7 +740,7 @@ dependencies = [
 
 [[package]]
 name = "c0mpute-verify"
-version = "0.2.29"
+version = "0.2.30"
 dependencies = [
  "anyhow",
  "blake3",
diff --git a/Cargo.toml b/Cargo.toml
index 0e65ba9..77d6b09 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,7 +23,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.2.29"
+version = "0.2.30"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/profullstack/c0mpute"
diff --git a/apps/tui/package.json b/apps/tui/package.json
index 758584a..4050a7a 100644
--- a/apps/tui/package.json
+++ b/apps/tui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@c0mpute/tui",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "bin": {
diff --git a/apps/web/package.json b/apps/web/package.json
index 570e438..df00c98 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "c0mpute",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/web/src/app/releases/latest.json/route.ts b/apps/web/src/app/releases/latest.json/route.ts
index 56bc7e0..88f366b 100644
--- a/apps/web/src/app/releases/latest.json/route.ts
+++ b/apps/web/src/app/releases/latest.json/route.ts
@@ -28,7 +28,7 @@ export const dynamic = "force-dynamic";
  * this in sync with the workspace version in `Cargo.toml` on each release so a
  * freshly built CLI reports "already latest" rather than a phantom upgrade.
  */
-const FALLBACK_VERSION = "0.2.29";
+const FALLBACK_VERSION = "0.2.30";
 const FALLBACK_MIN_REQUIRED = "0.0.1";
 
 type Channel = "stable" | "beta" | "nightly";
diff --git a/node/crates/c0mpute-cli/src/main.rs b/node/crates/c0mpute-cli/src/main.rs
index 45ad290..3e2b245 100644
--- a/node/crates/c0mpute-cli/src/main.rs
+++ b/node/crates/c0mpute-cli/src/main.rs
@@ -2199,6 +2199,10 @@ fn ensure_infernet_daemon() {
     if which_on_path("infernet").is_none() || !infernet_initialized() {
         return;
     }
+    if infernet_systemd_managed() {
+        tracing::info!("infernet daemon is managed by infernet.service; not starting another");
+        return;
+    }
     tracing::info!("ensuring infernet node daemon is running");
     let _ = infernet_cmd(&["start"]);
 }
@@ -2681,7 +2685,8 @@ fn refresh_plugins() {
         if let Some(path) = which_on_path(bin) {
             // `infernet update` has no version check: every call reinstalls and restarts the
             // daemon. Only run it when npm has something newer than what is installed.
-            if *bin == "infernet" && !infernet_update_available() {
+            // A systemd-managed daemon updates itself; `infernet update` would restart it from here.
+            if *bin == "infernet" && (infernet_systemd_managed() || !infernet_update_available()) {
                 continue;
             }
             tracing::debug!(plugin = bin, "checking plugin for upgrades");
@@ -2695,6 +2700,19 @@ fn refresh_plugins() {
     }
 }
 
+/// True when a systemd `infernet.service` is running the node daemon. That unit owns the daemon
+/// (and the daemon auto-updates itself), so the worker must not start, update or restart another
+/// one: two daemons on one config dir fight over the socket, port and pidfile.
+fn infernet_systemd_managed() -> bool {
+    Command::new("systemctl")
+        .args(["is-active", "--quiet", "infernet.service"])
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .is_ok_and(|s| s.success())
+}
+
 /// npm package the infernet installer pulls (`npm install -g @infernetprotocol/cli`).
 const INFERNET_NPM_LATEST: &str = "https://registry.npmjs.org/@infernetprotocol/cli/latest";
 
@@ -2764,6 +2782,11 @@ fn reap_stale_infernet_daemons() {
         return;
     }
     let me = unsafe { libc::getuid() };
+    // Only daemons this worker started (they share its cgroup): a daemon run by infernet.service or
+    // by hand is someone else's to manage.
+    let Ok(own_cgroup) = std::fs::read_to_string("/proc/self/cgroup") else {
+        return;
+    };
     let Ok(dir) = std::fs::read_dir("/proc") else {
         return;
     };
@@ -2784,6 +2807,10 @@ fn reap_stale_infernet_daemons() {
         };
         if !is_infernet_daemon_cmdline(&cmdline)
             || entry.metadata().map(|m| m.uid()).ok() != Some(me)
+            || std::fs::read_to_string(entry.path().join("cgroup"))
+                .ok()
+                .as_deref()
+                != Some(own_cgroup.as_str())
         {
             continue;
         }
diff --git a/package.json b/package.json
index db3a04f..16be507 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "c0mpute-monorepo",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "workspaces": [
     "apps/*",
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 627ae58..48c81d7 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@c0mpute/shared",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "./dist/index.js",