diff --git a/bin/netvm-node-down.sh b/bin/netvm-node-down.sh
index 90da0f9..4479bad 100755
--- a/bin/netvm-node-down.sh
+++ b/bin/netvm-node-down.sh
@@ -7,8 +7,10 @@ VETH="veth-${NODE}"
 IDX=$(( $(echo -n "$NODE" | cksum | cut -d' ' -f1) % 60 + 10 ))
 SUB="10.201.${IDX}.0/30"
 nsexec() { ip netns exec "$NETNS" "$@"; }
-nsexec ip link set "wg-${NODE}" down 2>/dev/null || true
+nsexec ip link del "wg-${NODE}" 2>/dev/null || true  # inside netns first
 ip link del "$VETH" 2>/dev/null || true   # also drops the netns-side peer
+ip link del "wg-${NODE}" 2>/dev/null || true  # stray host-side copy
 iptables -t nat -D POSTROUTING -s "$SUB" -j MASQUERADE 2>/dev/null || true
 ip netns del "$NETNS" 2>/dev/null || true
+ip link del "wg-${NODE}" 2>/dev/null || true  # final sweep post-reap
 echo "node=$NODE down"
diff --git a/bin/netvm-node-up.sh b/bin/netvm-node-up.sh
index 305bbe2..bdfc0c9 100755
--- a/bin/netvm-node-up.sh
+++ b/bin/netvm-node-up.sh
@@ -50,6 +50,7 @@ done
 
 # wireguard interface (wg setconf rejects wg-quick extensions: strip them)
 if ! nsexec ip link show "$WG" >/dev/null 2>&1; then
+  ip link del "$WG" 2>/dev/null || true   # stale host-side (reaped zombie netns)
   ip link add "$WG" type wireguard
   ip link set "$WG" netns "$NETNS"
 fi