diff --git a/nexus/db-model/src/instance.rs b/nexus/db-model/src/instance.rs
index dadf4e89ae3..fc6678369c1 100644
--- a/nexus/db-model/src/instance.rs
+++ b/nexus/db-model/src/instance.rs
@@ -3,7 +3,8 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 use super::{
-    ByteCount, Disk, ExternalIp, Generation, InstanceCpuCount, InstanceState,
+    ByteCount, Disk, ExternalIp, Generation, InstanceAutoRestart,
+    InstanceCpuCount, InstanceState,
 };
 use crate::collection::DatastoreAttachTargetConfig;
 use crate::schema::{disk, external_ip, instance};
@@ -54,8 +55,12 @@ pub struct Instance {
     #[diesel(column_name = hostname)]
     pub hostname: String,
 
-    #[diesel(column_name = boot_on_fault)]
-    pub boot_on_fault: bool,
+    /// The auto-restart policy for this instance.
+    ///
+    /// This indicates whether the instance should be automatically restarted by
+    /// the control plane on failure.
+    #[diesel(column_name = auto_restart_policy)]
+    pub auto_restart_policy: InstanceAutoRestart,
 
     #[diesel(embed)]
     pub runtime_state: InstanceRuntimeState,
@@ -104,7 +109,7 @@ impl Instance {
             ncpus: params.ncpus.into(),
             memory: params.memory.into(),
             hostname: params.hostname.to_string(),
-            boot_on_fault: false,
+            auto_restart_policy: InstanceAutoRestart::Never,
             runtime_state,
 
             updater_gen: Generation::new(),
diff --git a/nexus/db-model/src/instance_auto_restart.rs b/nexus/db-model/src/instance_auto_restart.rs
new file mode 100644
index 00000000000..1291a1e527c
--- /dev/null
+++ b/nexus/db-model/src/instance_auto_restart.rs
@@ -0,0 +1,42 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+use super::impl_enum_type;
+use serde::Deserialize;
+use serde::Serialize;
+use std::fmt;
+
+impl_enum_type!(
+    #[derive(SqlType, Debug)]
+    #[diesel(postgres_type(name = "instance_auto_restart", schema = "public"))]
+    pub struct InstanceAutoRestartEnum;
+
+    #[derive(Copy, Clone, Debug, PartialEq, AsExpression, FromSqlRow, Serialize, Deserialize)]
+    #[diesel(sql_type = InstanceAutoRestartEnum)]
+    pub enum InstanceAutoRestart;
+
+    // Enum values
+    Never => b"never"
+    AllFailures => b"all_failures"
+);
+
+impl InstanceAutoRestart {
+    pub fn label(&self) -> &'static str {
+        match self {
+            InstanceAutoRestart::Never => "never",
+            InstanceAutoRestart::AllFailures => "all_failures",
+        }
+    }
+}
+
+impl fmt::Display for InstanceAutoRestart {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "{}", self.label())
+    }
+}
+
+impl diesel::query_builder::QueryId for InstanceAutoRestart {
+    type QueryId = ();
+    const HAS_STATIC_QUERY_ID: bool = false;
+}
diff --git a/nexus/db-model/src/lib.rs b/nexus/db-model/src/lib.rs
index 82f4b78fa8f..e127ef1afd9 100644
--- a/nexus/db-model/src/lib.rs
+++ b/nexus/db-model/src/lib.rs
@@ -34,6 +34,7 @@ mod generation;
 mod identity_provider;
 mod image;
 mod instance;
+mod instance_auto_restart;
 mod instance_cpu_count;
 mod instance_state;
 mod inventory;
@@ -149,6 +150,7 @@ pub use generation::*;
 pub use identity_provider::*;
 pub use image::*;
 pub use instance::*;
+pub use instance_auto_restart::*;
 pub use instance_cpu_count::*;
 pub use instance_state::*;
 pub use inventory::*;
diff --git a/nexus/db-model/src/schema.rs b/nexus/db-model/src/schema.rs
index 5d9b3da78f8..fa6dd1fec79 100644
--- a/nexus/db-model/src/schema.rs
+++ b/nexus/db-model/src/schema.rs
@@ -407,7 +407,7 @@ table! {
         ncpus -> Int8,
         memory -> Int8,
         hostname -> Text,
-        boot_on_fault -> Bool,
+        auto_restart_policy -> crate::InstanceAutoRestartEnum,
         time_state_updated -> Timestamptz,
         state_generation -> Int8,
         active_propolis_id -> Nullable<Uuid>,