diff --git a/server/internal/services/inventory.go b/server/internal/services/inventory.go
index 2c81352..a8828d8 100644
--- a/server/internal/services/inventory.go
+++ b/server/internal/services/inventory.go
@@ -2,11 +2,14 @@ package services
 
 import (
 	"context"
+	"errors"
+	"log"
 	"time"
 
 	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/db"
 	"gitea.hostxtra.co.uk/vantage/vantage-shared/grpc/pb"
 	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
 	"go.mongodb.org/mongo-driver/v2/mongo/options"
 )
 
@@ -58,9 +61,14 @@ func StoreInventory(serverID string, r *pb.InventoryReport) error {
 				RebootRequiredSince *time.Time `bson:"reboot_required_since"`
 			} `bson:"inventory"`
 		}
-		_ = db.Col("servers").FindOne(ctx, bson.M{"server_id": serverID},
+		err := db.Col("servers").FindOne(ctx, bson.M{"server_id": serverID},
 			options.FindOne().SetProjection(bson.M{"inventory.reboot_required": 1, "inventory.reboot_required_since": 1})).Decode(&prev)
-		if since, clear := rebootSinceUpdate(prev.Inventory.RebootRequired, prev.Inventory.RebootRequiredSince, r.RebootRequired, now); since != nil {
+		// On a transient read error the previous stamp is unknown. Leaving it
+		// alone beats resetting it to now, which would restart "pending for N
+		// days" and hide a long-overdue reboot.
+		if err != nil && !errors.Is(err, mongo.ErrNoDocuments) {
+			log.Printf("inventory: read reboot state for %s: %v", serverID, err)
+		} else if since, clear := rebootSinceUpdate(prev.Inventory.RebootRequired, prev.Inventory.RebootRequiredSince, r.RebootRequired, now); since != nil {
 			set["inventory.reboot_required_since"] = *since
 		} else if clear {
 			unset = bson.M{"inventory.reboot_required_since": ""}