diff --git a/packages/server/src/utils/federationPeering.test.ts b/packages/server/src/utils/federationPeering.test.ts
index 3961dc0b..2b044795 100644
--- a/packages/server/src/utils/federationPeering.test.ts
+++ b/packages/server/src/utils/federationPeering.test.ts
@@ -1,4 +1,4 @@
-import { describe, it, expect, vi } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import type { EnsurePeeredResult } from './federationPeering.js';
 import { racePeering } from './federationPeering.js';
 
@@ -112,3 +112,59 @@ describe('racePeering', () => {
     warnSpy.mockRestore();
   });
 });
+
+describe('ensurePeered needs_attention handling', () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  it('returns rejected without calling performHandshake when peer is in needs_attention', async () => {
+    const fakeDbGet = vi.fn().mockReturnValue({
+      id: 'peer-na',
+      origin: 'https://remote.example',
+      status: 'needs_attention',
+      hmacSecret: 'secret',
+      createdAt: Date.now(),
+      lastSyncedAt: 0,
+    });
+
+    vi.doMock('../db/index.js', () => ({
+      getDb: () => ({
+        select: () => ({
+          from: () => ({
+            where: () => ({
+              get: fakeDbGet,
+            }),
+          }),
+        }),
+      }),
+    }));
+
+    vi.doMock('../utils/federationAuth.js', () => ({
+      getOurOrigin: () => 'https://local.example',
+      generateHmacSecret: () => 'new-secret',
+    }));
+
+    vi.doMock('../routes/federation.js', () => ({
+      validateOrigin: (o: string) => o,
+    }));
+
+    vi.doMock('../utils/federationPeerActivation.js', () => ({
+      onPeerActivated: vi.fn(),
+    }));
+
+    const { ensurePeered } = await import('./federationPeering.js');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+
+    const result = await ensurePeered('https://remote.example');
+
+    expect(result.status).toBe('rejected');
+    if (result.status === 'rejected') {
+      expect(result.error).toContain('needs_attention');
+    }
+    // performHandshake must not have fired — no POST to /peer/accept
+    expect(fetchSpy).not.toHaveBeenCalled();
+
+    vi.restoreAllMocks();
+  });
+});
diff --git a/packages/server/src/utils/federationPeering.ts b/packages/server/src/utils/federationPeering.ts
index 31bb4936..fc6b9ae2 100644
--- a/packages/server/src/utils/federationPeering.ts
+++ b/packages/server/src/utils/federationPeering.ts
@@ -73,6 +73,9 @@ export async function ensurePeered(origin: string): Promise<EnsurePeeredResult>
         // Unreachable peers were previously active — treat as active for peering
         // (the health check will restore them; don't re-handshake)
         return { status: 'active', peerId: existing.id };
+      case 'needs_attention':
+        // Admin intervention required — do not auto-heal via performHandshake
+        return { status: 'rejected', error: 'Peer in needs_attention — admin Reset required' };
       case 'awaiting_approval':
         return { status: 'pending', error: 'Awaiting admin approval on remote instance' };
       case 'pending':