diff --git a/projects/packages/waf/changelog/fix-waf-add-option-hooks b/projects/packages/waf/changelog/fix-waf-add-option-hooks
new file mode 100644
index 000000000000..bc51a61a91b5
--- /dev/null
+++ b/projects/packages/waf/changelog/fix-waf-add-option-hooks
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Fix firewall activation hooks on first option updates.
diff --git a/projects/packages/waf/src/class-waf-runner.php b/projects/packages/waf/src/class-waf-runner.php
index b6a545d5f611..da3eaf941527 100644
--- a/projects/packages/waf/src/class-waf-runner.php
+++ b/projects/packages/waf/src/class-waf-runner.php
@@ -57,8 +57,11 @@ public static function initialize() {
 	 * @return void
 	 */
 	public static function add_hooks() {
+		add_action( 'add_option_' . self::IP_ALLOW_LIST_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
 		add_action( 'update_option_' . self::IP_ALLOW_LIST_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
+		add_action( 'add_option_' . self::IP_BLOCK_LIST_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
 		add_action( 'update_option_' . self::IP_BLOCK_LIST_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
+		add_action( 'add_option_' . self::IP_LISTS_ENABLED_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
 		add_action( 'update_option_' . self::IP_LISTS_ENABLED_OPTION_NAME, array( static::class, 'activate' ), 10, 0 );
 		add_action( 'jetpack_waf_rules_update_cron', array( static::class, 'update_rules_cron' ) );
 		// TODO: This doesn't exactly fit here - may need to find another home