diff --git a/go/pkg/pwagent/daemon.go b/go/pkg/pwagent/daemon.go
index e622ee593..6a45b42d6 100644
--- a/go/pkg/pwagent/daemon.go
+++ b/go/pkg/pwagent/daemon.go
@@ -48,6 +48,9 @@ func Daemon(ctx context.Context, cli *client.Client, apiClient *http.Client, opt
 			break
 		}
 
+		opts.ForceRecreate = false // only do it once
+		opts.Cleanup = false       // only do it once
+
 		time.Sleep(opts.LoopDelay)
 	}
 	return nil
diff --git a/go/pkg/pwagent/nginx.go b/go/pkg/pwagent/nginx.go
index e3ba29830..d1f39b843 100644
--- a/go/pkg/pwagent/nginx.go
+++ b/go/pkg/pwagent/nginx.go
@@ -121,26 +121,26 @@ func ensureNginxContainer(ctx context.Context, dockerClient *client.Client, opts
 		if err != nil {
 			return errcode.ErrBuildNginxContainer.Wrap(err)
 		}
-		running = true
+		running = false
 	} else {
 		nginxContainerID = nginxContainer.ID
 		running = nginxContainer.State == "running"
 	}
 
 	// start nginx container if needed
-	if running {
+	if !running {
 		err = dockerClient.ContainerStart(ctx, nginxContainerID, types.ContainerStartOptions{})
 		if err != nil {
 			return errcode.ErrStartNginxContainer.Wrap(err)
 		}
-		nginxContainer, err = checkNginxContainer(ctx, dockerClient)
-		if err != nil {
-			return errcode.ErrCheckNginxContainer.Wrap(err)
-		}
 		logger.Info("started nginx", zap.String("id", nginxContainerID))
 	}
 
 	// connect nginx container to proxy network
+	nginxContainer, err = checkNginxContainer(ctx, dockerClient)
+	if err != nil {
+		return errcode.ErrCheckNginxContainer.Wrap(err)
+	}
 	if _, found := nginxContainer.NetworkSettings.Networks[pwcompose.ProxyNetworkName]; !found {
 		var proxyNetworkID string
 		networkResources, err := dockerClient.NetworkList(ctx, types.NetworkListOptions{})