diff --git a/opentofu/modules/opnsense-edge/main.tf b/opentofu/modules/opnsense-edge/main.tf
index 54828d5..c213b89 100644
--- a/opentofu/modules/opnsense-edge/main.tf
+++ b/opentofu/modules/opnsense-edge/main.tf
@@ -224,5 +224,26 @@
         target = { port = "0" }
       }
     ]
+
+    # D-129 qemu-guest-agent transport. OPT-IN (var.expose_qga_channel, default OFF --
+    # see variables.tf for why defaulting it ON would bounce every existing edge).
+    #
+    # The os-qemu-guest-agent PACKAGE is useless without this: the agent speaks over a
+    # virtio-serial channel named org.qemu.guest_agent.0, and with no channel device the
+    # package installs, reports "present", and can never answer. That false-success is
+    # precisely what the D-129 review flagged -- so the package and this channel are one
+    # decision, not two.
+    #
+    # SHAPE IS FROM THE PROVIDER SCHEMA, not from a blog: `tofu providers schema -json`
+    # on dmacvicar 0.9.8 gives devices.channels[].target.virt_io = {name, state} and
+    # source.unix = {mode, path, ...}. `source.unix` with NO path lets libvirt allocate
+    # the socket itself (the same reasoning the serial block documents for pty: a path
+    # libvirt assigns at start time cannot be known in advance, so do not invent one).
+    channels = var.expose_qga_channel ? [
+      {
+        source = { unix = { mode = "bind" } }
+        target = { virt_io = { name = "org.qemu.guest_agent.0" } }
+      }
+    ] : []
   }
 }
diff --git a/opentofu/modules/opnsense-edge/variables.tf b/opentofu/modules/opnsense-edge/variables.tf
index 8a91cba..8c1d129 100644
--- a/opentofu/modules/opnsense-edge/variables.tf
+++ b/opentofu/modules/opnsense-edge/variables.tf
@@ -75,3 +75,23 @@
   type        = bool
   default     = false
 }
+
+variable "expose_qga_channel" {
+  description = <<-EOT
+    D-129: expose the org.qemu.guest_agent.0 virtio-serial channel on this edge.
+
+    OPT-IN, DEFAULT OFF BY DESIGN. Adding a device changes the domain, and on an
+    ALREADY-BUILT edge that means a replace + reboot of a live router. Defaulting
+    this ON would bounce every existing edge the next time anyone ran a plan. So:
+    existing edges are untouched, and NEW DC edges set it true so they boot with
+    the channel and never need the retrofit (D-129 Implementation prep).
+
+    WITHOUT the channel the os-qemu-guest-agent PACKAGE still installs and still
+    appears "present" -- but it has no transport and can never answer, which is
+    exactly the false-success the D-129 review warned about. The package is only
+    meaningful when this is true. Verify with `virsh ... guest-ping`, never by
+    package listing alone.
+  EOT
+  type        = bool
+  default     = false
+}
diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf
index 24600b2..1c805e6 100644
--- a/opentofu/vr1-dc0-substrate/main.tf
+++ b/opentofu/vr1-dc0-substrate/main.tf
@@ -67,6 +67,9 @@
   base_volume_path = var.opnsense_base_path
   lan_network_name = module.vr1_dc0_planes.network_names["provider-public"]
   wan_network_name = module.vr1_dc0_wan.network_name
+  # D-129: NEW DC edges boot WITH the qga channel so they never need the retrofit
+  # (operator-ruled 2026-07-20). The office1 edge stays untouched at the default OFF.
+  expose_qga_channel = true
 }
 
 # D-121 Option C layout (R-3 2026-07-16): 3 control + 2 compute + 4 storage = 9 nodes/DC.