diff --git a/run_once_20-install-user-packages.sh.tmpl b/run_once_20-install-user-packages.sh.tmpl
index 104ab15..ba2a2fb 100755
--- a/run_once_20-install-user-packages.sh.tmpl
+++ b/run_once_20-install-user-packages.sh.tmpl
@@ -64,13 +64,8 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
 fi
 
 # Debian ships 'bat' as 'batcat' due to a name clash with an unrelated
-# package. Install upstream 'bat' via cargo so we get the real binary at
-# $HOME/.cargo/bin/bat. Faster than apt's renamed package, version-aligned
-# with arch's pacman install.
-if command -v cargo >/dev/null 2>&1 && ! command -v bat >/dev/null 2>&1; then
-    log "installing bat via cargo (upstream, debian renames it to batcat)"
-    cargo install bat --locked 2>&1 | tail -5
-fi
+# package. The install happens in run_onchange_30 (after rustup is ready,
+# via `cargo install bat`).
 
 # Neovim — install official binary tarball, pinned to a known-good version.
 # Bump NVIM_TARGET_VERSION to upgrade. ~/.local/bin/update-neovim.sh does
diff --git a/run_onchange_30-ensure-cargo.sh.tmpl b/run_onchange_30-ensure-cargo.sh.tmpl
index c2561cd..42a9b07 100755
--- a/run_onchange_30-ensure-cargo.sh.tmpl
+++ b/run_onchange_30-ensure-cargo.sh.tmpl
@@ -2,6 +2,9 @@
 # =============================================================================
 #  run_onchange_30-ensure-cargo.sh.tmpl
 #  Make sure rustup/cargo is available. If not, install rustup.
+#  After cargo is ready, install bat from crates.io on debian (apt renames
+#  upstream bat to batcat, which breaks .zshrc's `alias cat=bat`).
+#
 #  Runs on every apply because the script body rarely changes but we want a
 #  fresh check after package installs.
 # =============================================================================
@@ -9,21 +12,35 @@ set -euo pipefail
 
 log() { printf '\033[1;34m[cargo]\033[0m %s\n' "$*"; }
 
-if command -v cargo >/dev/null 2>&1; then
-    log "cargo already installed: $(cargo --version)"
-    exit 0
+# --- 1. Ensure cargo is on PATH ---
+if ! command -v cargo >/dev/null 2>&1; then
+    if command -v rustup >/dev/null 2>&1; then
+        log "rustup present but cargo missing — running rustup default"
+        rustup default stable
+    else
+        log "no cargo or rustup — installing rustup"
+        sh -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y --default-toolchain stable --profile minimal
+        # shellcheck disable=SC1091
+        source "$HOME/.cargo/env"
+    fi
 fi
 
-if command -v rustup >/dev/null 2>&1; then
-    log "rustup present but cargo missing — running rustup default"
-    rustup default stable
-    exit 0
+# Ensure subsequent commands in this script can find cargo
+export PATH="$HOME/.cargo/bin:$PATH"
+
+log "rustup installed: $(rustup --version 2>/dev/null || echo unknown)"
+log "cargo installed: $(cargo --version)"
+
+# --- 2. Install bat from crates.io if missing (debian only) ---
+{{ if eq .os_family "debian" -}}
+if ! command -v bat >/dev/null 2>&1; then
+    log "installing bat via cargo (upstream, debian renames it to batcat)"
+    cargo install bat --locked
+    log "bat installed: $(bat --version)"
+else
+    log "bat already installed: $(bat --version)"
 fi
-
-log "no cargo or rustup — installing rustup"
-sh -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y --default-toolchain stable --profile minimal
-# shellcheck disable=SC1091
-source "$HOME/.cargo/env"
-
-log "rustup installed: $(rustup --version)"
-log "cargo installed: $(cargo --version)"
\ No newline at end of file
+{{ else -}}
+# Arch already installs upstream bat via pacman; nothing extra to do.
+log "skipping cargo bat install (os_family={{ .os_family }}, pacman handles it)"
+{{ end -}}
\ No newline at end of file