diff --git a/infra/ansible/roles/node_baseline/tasks/main.yml b/infra/ansible/roles/node_baseline/tasks/main.yml
index 10e0058..bf84e9d 100644
--- a/infra/ansible/roles/node_baseline/tasks/main.yml
+++ b/infra/ansible/roles/node_baseline/tasks/main.yml
@@ -35,14 +35,28 @@
       fs.inotify.max_user_watches         = 524288
   notify: Reload sysctl
 
-- name: Enable and start iscsid (Longhorn) and qemu-guest-agent
+- name: Enable and start iscsid (Longhorn prerequisite)
   ansible.builtin.systemd:
-    name: "{{ item }}"
+    name: iscsid
     enabled: true
     state: started
-  loop:
-    - iscsid
-    - qemu-guest-agent
+
+# qemu-guest-agent binds to the virtio-serial channel /dev/virtio-ports/org.qemu.guest_agent.0,
+# which Proxmox attaches only when the VM's `agent` option is enabled. Our tofu keeps agent
+# DISABLED on purpose (enabling it makes `tofu apply` block up to 15m waiting for an agent the
+# stock Debian cloud image hasn't installed yet — bpg gotcha). So we ENABLE the unit for the day
+# a channel exists, but only START it when the channel is actually present — never fail the
+# baseline over a missing hypervisor channel.
+- name: Check whether the qemu guest-agent virtio channel is attached
+  ansible.builtin.stat:
+    path: /dev/virtio-ports/org.qemu.guest_agent.0
+  register: node_baseline_qga_channel
+
+- name: Enable qemu-guest-agent (start only when its virtio channel is present)
+  ansible.builtin.systemd:
+    name: qemu-guest-agent
+    enabled: true
+    state: "{{ 'started' if node_baseline_qga_channel.stat.exists else 'stopped' }}"
 
 - name: Create ext4 filesystem on the Longhorn data disk (data-safe; skips if present)
   community.general.filesystem: