diff --git a/nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix b/nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix
index 855d5d1..a088758 100644
--- a/nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix
+++ b/nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix
@@ -186,6 +186,33 @@ SSHCFG
     '';
   };
 
+  # p-lichen-orchestrator supervisor — the SEPARATE lichen.page testing/hardening orchestrator
+  # (distinct from cc-ci-loops above). Reboot-resilience: on boot, resume the orchestrator's Remote
+  # Control session + watchdog + pipeline via `engine/agents.py up`. Added 2026-07-08 after a reboot
+  # (Hetzner rollback) left this orchestrator down while cc-ci-loops auto-recovered.
+  # NOTE: still points at the /home path — will be re-pointed to /srv when that migration happens.
+  systemd.services.lichen-orchestrator = {
+    description = "p-lichen-orchestrator (lichen.page testing) — orchestrator + watchdog + pipeline";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" "tailscaled.service" "claude-install.service" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot"; RemainAfterExit = true;
+      User = "loops"; Group = "users";
+      WorkingDirectory = "/home/loops/project-orchestrator/projects/p-lichen-orchestrator";
+    };
+    environment = { HOME = "/home/loops"; CLAUDE_BIN = "/home/loops/.local/bin/claude"; };
+    path = [ pkgs.bash pkgs.tmux pkgs.git pkgs.python3 pkgs.openssh pkgs.nettools ];
+    script = ''
+      export PATH="/home/loops/.local/bin:$PATH"
+      proj="/home/loops/project-orchestrator/projects/p-lichen-orchestrator"
+      # boot marker (best-effort; boot_id-gated logging can be added later)
+      echo "$(cat /proc/sys/kernel/random/boot_id) boot $(date -u +%FT%TZ) — lichen-orchestrator up" \
+        >> "$proj/.ao-state/boot.log" 2>/dev/null || true
+      cd "$proj" && python3 engine/agents.py up || echo "p-lichen agents.py up failed"
+    '';
+  };
+
   # Weekly recipe upgrade — runs /upgrade-all over every enrolled recipe (opens recipe PRs
   # verified by !testme, never merges). Replaces the boot-fragile busybox-crond-in-tmux from
   # phase 5 §4 with a reboot-safe systemd timer. The service is timer-triggered only (NOT