diff --git a/debian/control b/debian/control
index e2f656c4b..ed743c6b4 100644
--- a/debian/control
+++ b/debian/control
@@ -49,6 +49,7 @@ Description: Tools for configuring non-Qubes-aware applications from QubesDB.
 Package: securedrop-whonix-config
 Section: admin
 Architecture: all
+# FIXME: s/tor/anon-gw-anonymizer-config/ (requires Whonix repositories in piuparts)
 Depends: ${misc:Depends}, securedrop-qubesdb-tools, tor
 Description: Whonix configuration for SecureDrop.
  This package configures Whonix/Tor for SecureDrop.
diff --git a/debian/securedrop-whonix-config.securedrop-whonix-config.service b/debian/securedrop-whonix-config.securedrop-whonix-config.service
index 5f44e46b8..993ccb864 100644
--- a/debian/securedrop-whonix-config.securedrop-whonix-config.service
+++ b/debian/securedrop-whonix-config.securedrop-whonix-config.service
@@ -1,7 +1,16 @@
 [Unit]
 Description=SecureDrop Whonix configuration
 ConditionPathExists=/var/run/qubes-service/securedrop-whonix-config
+
+# Both Qubes's qubes-qrexec-agent (for QubesDB) and Whonix's
+# anon-gw-anonymizer-config (for configuration directories) must
+# have started *before* this service for it to run successfully,
+# since it's a one-shot operation rather than a long-lived service.
+Requires=anon-gw-anonymizer-config.service
+After=anon-gw-anonymizer-config.service
+Requires=qubes-qrexec-agent.service
 After=qubes-qrexec-agent.service
+
 Before=tor.service
 
 [Service]