[eyegor]

Why don't you just add sshd restart as an interface PostUp step in the client's wireguard config file?

[inbetween]

it only takes 3 lines in a systemd override fille (which I think don't suffer the overwrite-on-upgrade problem). To my mind, that keeps the startup logic nicely local in service files.

[kardos]

So allow sshd to start in a failed mode and then restart it?