diff --git a/server/start.sh b/server/start.sh
index c4b2352..b243e09 100755
--- a/server/start.sh
+++ b/server/start.sh
@@ -3,8 +3,22 @@
 # sidecar, see its own README) in the background, bound to 127.0.0.1 --
 # reachable from this container's Python process, never from outside it.
 # Then execs uvicorn as the foreground/PID 1 process so it receives
-# Docker's stop signal directly. The backgrounded Node process has no
-# state worth flushing on shutdown -- fine for it to just die with the
-# container.
-node ./render-service/server.js &
+# Docker's stop signal directly.
+#
+# Wrapped in a restart loop, not a bare `node ... &`: a bare background
+# process that crashes stays dead for good, with nothing to bring it
+# back -- turning any single render crash (a not-yet-found jsdom/
+# Excalidraw edge case, say) into a silent, permanent whiteboard outage
+# that looks exactly like "stuck showing stale content forever" from the
+# outside, since routers/common.py's get_or_refresh_whiteboard falls
+# back to the last good cached image on every failed refresh rather than
+# going blank. The 2s sleep just avoids a hot-crash-loop pegging a core
+# if something's wrong at every single startup.
+(
+  while true; do
+    node ./render-service/server.js
+    echo "whiteboard render sidecar exited (code $?) -- restarting in 2s" >&2
+    sleep 2
+  done
+) &
 exec uvicorn app.main:app --host 0.0.0.0 --port 8420