diff --git a/README.md b/README.md
index 4a54197..3f22210 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,11 @@ Run in order from this directory:
 
 Config (IPs, sizing, password, ISO version) lives in [`lab.env`](lab.env).
 
+After a host reboot (VMs already exist, just need to come back up):
+```bash
+./start-lab.sh   # re-arms libvirt/network/NAT state and starts the 3 VMs
+```
+
 ## Access
 - Web UI: <https://10.10.10.11:8006> and <https://10.10.10.12:8006>
 - Login: `root` / value of `ROOT_PASSWORD` in `lab.env`
diff --git a/start-lab.sh b/start-lab.sh
new file mode 100755
index 0000000..967ea51
--- /dev/null
+++ b/start-lab.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Bring the lab back up after a host reboot. Assumes the VMs, network, and
+# storage pools were already created by a prior 00-07 run — this does NOT
+# (re)install anything, it just re-establishes libvirt/networking state that
+# doesn't survive a reboot (modular daemon sockets, the NAT/forward iptables
+# rules) and starts the existing VMs.
+set -euo pipefail
+source "$(dirname "$0")/lab.env"
+
+sudo -v   # prompt for the sudo password once, up front
+
+# Re-run the (idempotent) daemon + pool + network setup. Safe to do before any
+# VM is started: 01-network.sh recreates the pve-net bridge, which would orphan
+# any already-running VM's tap device — so this must happen first, while all
+# VMs are still shut off.
+echo "==> Re-establishing libvirt daemons, storage pools, and pve-net (with NAT rules)"
+"${SCRIPT_DIR}/00-prereqs.sh"
+"${SCRIPT_DIR}/01-network.sh"
+
+echo "==> Starting VMs"
+missing=0
+for name in "$PVE1_NAME" "$PVE2_NAME" "$STORE_NAME"; do
+  state=$(sudo virsh domstate "$name" 2>/dev/null || echo "missing")
+  case "$state" in
+    running)   echo "    $name already running" ;;
+    "shut off") echo "    starting $name"; sudo virsh start "$name" ;;
+    paused)    echo "    resuming $name"; sudo virsh resume "$name" ;;
+    missing)   echo "    ERROR: $name is not defined in libvirt"; missing=1 ;;
+    *)         echo "    $name is '$state'; leaving as-is" ;;
+  esac
+done
+if [[ "$missing" == 1 ]]; then
+  echo "One or more VMs don't exist yet — run the full ./00 through ./07 build first."
+  exit 1
+fi
+
+wait_ssh() {
+  local ip="$1" name="$2" tries=0
+  echo "==> Waiting for $name ($ip) over SSH"
+  while ! lab_ssh "$ip" true >/dev/null 2>&1; do
+    sleep 5
+    tries=$((tries+1))
+    if (( tries % 12 == 0 )); then echo "    still waiting for $name ... (${tries}0s)"; fi
+    if (( tries > 60 )); then echo "    WARN: $name not reachable after 5m; check 'virsh console $name'"; return 1; fi
+  done
+  echo "    $name is up"
+}
+wait_ssh "$PVE1_IP" "$PVE1_NAME" || true
+wait_ssh "$PVE2_IP" "$PVE2_NAME" || true
+wait_ssh "$STORE_IP" "$STORE_NAME" || true
+
+echo "==> Cluster status"
+lab_ssh "$PVE1_IP" "pvecm status" 2>/dev/null || echo "    (pve1 not reachable yet; re-run this script or check the VM console)"
+
+echo
+echo "Lab is up. Web UIs: https://${PVE1_IP}:8006  https://${PVE2_IP}:8006"
+echo "Run ./cluster-info.sh to refresh CLUSTER-INFO.md, or ./verify.sh for a full check."