diff --git a/run_once_05-install-pacstall.sh.tmpl b/run_once_05-install-pacstall.sh.tmpl
index f4654f8..2c249ba 100644
--- a/run_once_05-install-pacstall.sh.tmpl
+++ b/run_once_05-install-pacstall.sh.tmpl
@@ -24,17 +24,24 @@ if command -v pacstall >/dev/null 2>&1; then
     exit 0
 fi
 
-# Install pacstall's apt deps first (idempotent — pacstall will skip if present)
-log "installing pacstall apt dependencies"
+# Update apt cache (installer needs it)
 sudo apt-get update -y
+
+# Make sure we have the tools the pacstall installer needs to fetch and
+# verify its own dependencies. It handles the rest itself.
+log "ensuring pacstall installer prerequisites"
 sudo apt-get install -y --no-install-recommends \
-    sudo wget build-essential unzip git zstd iputils-ping \
-    aptitude bubblewrap jq distro-info-data spdx-licenses \
-    gettext curl ca-certificates
+    curl wget ca-certificates sudo
 
 # Fetch and run pacstall's official installer.
 # It must be invoked as root (sudo). NON_INTERACTIVE=true + </dev/null so it
 # doesn't prompt for the "install axel?" question.
+# The installer installs its own apt dependencies (sudo, wget, build-essential,
+# unzip, git, zstd, iputils-ping, aptitude, bubblewrap, jq, distro-info-data,
+# spdx-licenses, gettext, curl, ca-certificates, optionally axel). For packages
+# not in the host's apt repos (e.g. spdx-licenses on debian trixie), the
+# installer has a built-in fallback that downloads the .deb directly from
+# ftp.debian.org and installs it with apt install.
 log "downloading pacstall installer"
 PACSTALL_INSTALLER="$(mktemp /tmp/pacstall-install.XXXXXX.sh)"
 if ! curl -fL --retry 3 https://pacstall.dev/q/install -o "$PACSTALL_INSTALLER"; then