diff --git a/etc/init_common_services.sh b/etc/init_common_services.sh
index c1f3a5f..b54e7cc 100755
--- a/etc/init_common_services.sh
+++ b/etc/init_common_services.sh
@@ -596,10 +596,19 @@ case "$ACTION" in
     ;;
 esac
 
-if [ -x "$SCRIPT_DIR/init_opentofu.sh" ]; then
-  ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-300s}" "$SCRIPT_DIR/init_opentofu.sh" -n "$NS" "$ACTION" || rc=$?
+# ---------------------------------------------------------------------------
+# Deploy services in dependency order:
+#   1. Registry   – no dependencies; other services pull images from it
+#   2. OpenBao    – secrets vault; needed by downstream services
+#   3. Garage     – object storage
+#   4. OpenTofu   – IaC engine; depends on registry + secrets
+# ---------------------------------------------------------------------------
+
+if [ -x "$SCRIPT_DIR/init_registry.sh" ]; then
+  REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$NS" \
+    "$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" "$ACTION" || rc=$?
 else
-  echo "WARN: init_opentofu.sh not found; skipping OpenTofu."
+  echo "WARN: init_registry.sh not found; registry deploy skipped."
 fi
 
 if [ -x "$SCRIPT_DIR/init_openbao.sh" ]; then
@@ -609,13 +618,6 @@ else
   echo "WARN: init_openbao.sh not found; skipping OpenBao."
 fi
 
-if [ -x "$SCRIPT_DIR/init_registry.sh" ]; then
-  REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$NS" \
-    "$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" "$ACTION" || rc=$?
-else
-  echo "WARN: init_registry.sh not found; registry deploy skipped."
-fi
-
 if [ -x "$SCRIPT_DIR/init_garage_store.sh" ]; then
   garage_action="$ACTION"
   case "$garage_action" in
@@ -627,6 +629,12 @@ else
   echo "WARN: init_garage_store.sh not found; garage deploy skipped."
 fi
 
+if [ -x "$SCRIPT_DIR/init_opentofu.sh" ]; then
+  ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-300s}" "$SCRIPT_DIR/init_opentofu.sh" -n "$NS" "$ACTION" || rc=$?
+else
+  echo "WARN: init_opentofu.sh not found; skipping OpenTofu."
+fi
+
 if [[ "$ENABLE_KERBEROS" == "1" ]]; then
   # KDC is now embedded in the `knoe-auth` pod (multi-container) by default.
   # Only deploy a standalone KDC when explicitly requested.
diff --git a/mock_val/init_common_services.sh b/mock_val/init_common_services.sh
index 29cec3c..b4d488d 100755
--- a/mock_val/init_common_services.sh
+++ b/mock_val/init_common_services.sh
@@ -596,10 +596,19 @@ case "$ACTION" in
     ;;
 esac
 
-if [ -x "$SCRIPT_DIR/init_opentofu.sh" ]; then
-  ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-300s}" "$SCRIPT_DIR/init_opentofu.sh" -n "$NS" "$ACTION" || rc=$?
+# ---------------------------------------------------------------------------
+# Deploy services in dependency order:
+#   1. Registry   – no dependencies; other services pull images from it
+#   2. OpenBao    – secrets vault; needed by downstream services
+#   3. Garage     – object storage
+#   4. OpenTofu   – IaC engine; depends on registry + secrets
+# ---------------------------------------------------------------------------
+
+if [ -x "$SCRIPT_DIR/init_registry.sh" ]; then
+  REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$NS" \
+    "$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" "$ACTION" || rc=$?
 else
-  echo "WARN: init_opentofu.sh not found; skipping OpenTofu."
+  echo "WARN: init_registry.sh not found; registry deploy skipped."
 fi
 
 if [ -x "$SCRIPT_DIR/init_openbao.sh" ]; then
@@ -609,13 +618,6 @@ else
   echo "WARN: init_openbao.sh not found; skipping OpenBao."
 fi
 
-if [ -x "$SCRIPT_DIR/init_registry.sh" ]; then
-  REGISTRY_NAMESPACE="$REGISTRY_NS" SERVICE_NAMESPACE="$NS" \
-    "$SCRIPT_DIR/init_registry.sh" -n "$REGISTRY_NS" "$ACTION" || rc=$?
-else
-  echo "WARN: init_registry.sh not found; registry deploy skipped."
-fi
-
 if [ -x "$SCRIPT_DIR/init_garage_store.sh" ]; then
   garage_action="$ACTION"
   case "$garage_action" in
@@ -627,6 +629,12 @@ else
   echo "WARN: init_garage_store.sh not found; garage deploy skipped."
 fi
 
+if [ -x "$SCRIPT_DIR/init_opentofu.sh" ]; then
+  ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-300s}" "$SCRIPT_DIR/init_opentofu.sh" -n "$NS" "$ACTION" || rc=$?
+else
+  echo "WARN: init_opentofu.sh not found; skipping OpenTofu."
+fi
+
 if [[ "$ENABLE_KERBEROS" == "1" ]]; then
   if [ -x "$SCRIPT_DIR/init_kdc.sh" ]; then
     kdc_action="$ACTION"