diff --git a/modules/services/buildkite-agent.nix b/modules/services/buildkite-agent.nix
index 96c2f3b..936446d 100644
--- a/modules/services/buildkite-agent.nix
+++ b/modules/services/buildkite-agent.nix
@@ -16,18 +16,16 @@ let
   mkHookOptions = hooks: listToAttrs (map mkHookOption hooks);
 
   hooksDir = let
-    mkHookEntry = name: value: ''
-      cat > $out/${name} <<EOF
-      #! ${pkgs.stdenv.shell}
-      set -e
-      ${value}
-      EOF
-      chmod 755 $out/${name}
-    '';
-  in pkgs.runCommand "buildkite-agent-hooks" {} ''
-    mkdir $out
-    ${concatStringsSep "\n" (mapAttrsToList mkHookEntry (filterAttrs (n: v: v != null) cfg.hooks))}
-  '';
+    mkHookEntry = name: value: {
+      inherit name;
+      path = pkgs.writeScript "buildkite-agent-hook-${name}" ''
+        #! ${pkgs.stdenv.shell}
+        set -e
+        ${value}
+      '';
+    };
+  in pkgs.linkFarm "buildkite-agent-hooks"
+    (mapAttrsToList mkHookEntry (filterAttrs (n: v: v != null) cfg.hooks));
 
 in
 
@@ -221,11 +219,20 @@ in
           '';
 
         serviceConfig = {
-          KeepAlive = true;
-          RunAtLoad = true;
           ProcessType = "Interactive";
           ThrottleInterval = 30;
 
+          # The combination of KeepAlive.NetworkState and WatchPaths
+          # will ensure that buildkite-agent is started on boot, but
+          # after networking is available (so the hostname is
+          # correct).
+          RunAtLoad = true;
+          KeepAlive.NetworkState = true;
+          WatchPaths = [
+            "/etc/resolv.conf"
+            "/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist"
+          ];
+
           GroupName = "buildkite-agent";
           UserName = "buildkite-agent";
           WorkingDirectory = config.users.users.buildkite-agent.home;
diff --git a/tests/services-buildkite-agent.nix b/tests/services-buildkite-agent.nix
index 518d3ac..4ca89b8 100644
--- a/tests/services-buildkite-agent.nix
+++ b/tests/services-buildkite-agent.nix
@@ -12,7 +12,7 @@ in
     extraConfig = "yolo=1";
     openssh.privateKeyPath = "/dev/null";
     openssh.publicKeyPath = "/dev/null";
-    hooks.command = "echo test";
+    hooks.command = "echo test hook";
     inherit tokenPath;
   };
 
@@ -24,5 +24,9 @@ in
     script=$(cat ${config.out}/Library/LaunchDaemons/org.nixos.buildkite-agent.plist | awk -F'[< ]' '$3 ~ "^/nix/store/.*" {print $3}')
     grep "yolo=1" "$script"
     grep "${tokenPath}" "$script"
+
+    echo "checking that a buildkite-agent hook works" >&2
+    hooks_path=$(cat $script | awk -F'"' '/^hooks-path/ {print $2;}')
+    $hooks_path/command | grep test
   '';
 }