diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index 88f7fea..16a10c9 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -153,6 +153,14 @@ lib.mkIf enabled {
     createHome = false;
   };
 
+  # home-manager-<user>.service fails on first enrollment because /home/wayne
+  # doesn't exist until the user's first login (pam_mkhomedir creates it then).
+  # ConditionPathExists makes systemd skip the service (exit 0, condition not
+  # met) instead of failing. After first login the dir exists and subsequent
+  # rebuilds activate HM normally.
+  systemd.services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists =
+    "/home/${vars.ipaUser}";
+
   security.sudo.extraRules = [{
     users = [ vars.ipaUser ];
     commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];