diff --git a/scripts/docker/install/rootless/rootless_docker.sh b/scripts/docker/install/rootless/rootless_docker.sh
index 3c2932d..96416d8 100755
--- a/scripts/docker/install/rootless/rootless_docker.sh
+++ b/scripts/docker/install/rootless/rootless_docker.sh
@@ -101,10 +101,17 @@ installDockerRootless()
         local result; result=$(runSystem loginctl enable-linger $CFG_DOCKER_INSTALL_USER)
         checkSuccess "Adding automatic start (linger)"
 
-            # Rootless Install
+            # Install rootless Docker and enable the user service, but do NOT
+            # start it here. The rootless network override (override.conf,
+            # written further down) and the daemon-reload that picks it up
+            # haven't happened yet, so a start at this point comes up with no
+            # valid net/port-driver config and fails ("Job for docker.service
+            # failed") — a guaranteed, harmless first-start error that only
+            # noises the error report. The first real start is the
+            # `systemctl --user restart docker` below, once the override is in
+            # place.
 rootless_install=$(cat <<EOF
     curl -fsSL https://get.docker.com/rootless | sh && \
-    systemctl --user start docker && \
     systemctl --user enable docker && \
     exit
 EOF