diff --git a/scripts/cpuid-passthrough-watch b/scripts/cpuid-passthrough-watch
index ea60fa5..215ffd1 100755
--- a/scripts/cpuid-passthrough-watch
+++ b/scripts/cpuid-passthrough-watch
@@ -23,9 +23,6 @@ PARAM=/sys/module/kvm_amd/parameters
 V="virsh -c qemu:///system"
 
 running() { [ "$($V domstate "$DOMAIN" 2>/dev/null)" = running ]; }
-
-tap=$($V domiflist "$DOMAIN" 2>/dev/null | awk '$1 ~ /^(vnet|tap|macvtap)/ {print $1; exit}')
-RX="/sys/class/net/$tap/statistics/rx_packets"
 rx() { cat "$RX" 2>/dev/null || echo 0; }
 
 set_N() { echo N > "$PARAM/cpuid_passthrough"; }
@@ -46,6 +43,14 @@ wait_net_up() {
     return 0
 }
 
+# The hook arms this watcher at prepare, before QEMU starts, so the domain is not
+# yet running and its tap does not exist. Wait for the domain, then read the tap;
+# otherwise the first running check in wait_net_up bails and the flip never happens.
+for _ in $(seq 1 120); do running && break; sleep 1; done
+running || exit 0
+tap=$($V domiflist "$DOMAIN" 2>/dev/null | awk '$1 ~ /^(vnet|tap|macvtap)/ {print $1; exit}')
+RX="/sys/class/net/$tap/statistics/rx_packets"
+
 # initial cold boot: wait for the network, then harden
 wait_net_up 0
 running || exit 0