diff --git a/bot_bottle/backend/docker/infra_launch.py b/bot_bottle/backend/docker/infra_launch.py
index 224412f4..288e5084 100644
--- a/bot_bottle/backend/docker/infra_launch.py
+++ b/bot_bottle/backend/docker/infra_launch.py
@@ -89,6 +89,11 @@ def running_agent_containers(
         "docker", "network", "inspect", "--format",
         "{{range .Containers}}{{.Name}}\n{{end}}", network,
     ])
+    if proc.returncode != 0:
+        detail = proc.stderr.strip() or f"exit {proc.returncode}"
+        raise InfraLaunchError(
+            f"could not enumerate bottles on gateway network {network}: {detail}"
+        )
     return [
         name for name in (line.strip() for line in proc.stdout.splitlines())
         if name and name != gateway_name
diff --git a/tests/unit/test_backend_secret_reprovision.py b/tests/unit/test_backend_secret_reprovision.py
index 60671cb0..9a918838 100644
--- a/tests/unit/test_backend_secret_reprovision.py
+++ b/tests/unit/test_backend_secret_reprovision.py
@@ -262,6 +262,14 @@ class TestDockerAttachPrimitives(unittest.TestCase):
             with self.assertRaises(FileNotFoundError):
                 docker.running_agent_containers()
 
+    def test_running_agent_containers_fails_hard_on_inspect_failure(self) -> None:
+        inspect = _proc(1, stderr="network unavailable")
+        with patch.object(docker, "run_docker", return_value=inspect):
+            with self.assertRaisesRegex(
+                docker.InfraLaunchError, "network unavailable",
+            ):
+                docker.running_agent_containers(network="net")
+
     def test_push_ca_cp_then_rebuilds_trust_store(self) -> None:
         with patch.object(
             docker, "run_docker", side_effect=[_proc(), _proc(), _proc()],