diff --git a/modules/ha/cluster-config.nix b/modules/ha/cluster-config.nix
index 2cce76a..37b6eb9 100644
--- a/modules/ha/cluster-config.nix
+++ b/modules/ha/cluster-config.nix
@@ -37,6 +37,12 @@
   # DRBD lock-file directory (drbd-utils checks for it; missing → harmless but noisy warnings).
   systemd.tmpfiles.rules = [ "d /var/lib/drbd 0750 root root -" ];
 
+  # Prevent drbd.service from auto-starting at boot / nixos-rebuild switch.
+  # Pacemaker's OCF drbd agent calls drbdadm up/down directly when managing
+  # the resource.  If drbd.service also runs drbdadm up all while DRBD is
+  # already Primary under Pacemaker, apply-al fails with "device busy" (exit 20).
+  systemd.services.drbd.wantedBy = lib.mkForce [];
+
   services.drbd = {
     enable = true;
     config = ''