diff --git a/run_once_10-add-chaotic-aur.sh.tmpl b/run_once_10-add-chaotic-aur.sh.tmpl
index ab8417e..3d84896 100755
--- a/run_once_10-add-chaotic-aur.sh.tmpl
+++ b/run_once_10-add-chaotic-aur.sh.tmpl
@@ -8,6 +8,9 @@
 #    1. Get and sign the key
 #    2. Install chaotic-keyring + chaotic-mirrorlist
 #    3. Append repo to /etc/pacman.conf
+#
+#  Body is wrapped in an os_family conditional: this script is a no-op on
+#  debian (or anything non-arch).
 # =============================================================================
 set -euo pipefail
 
@@ -17,25 +20,26 @@ die() { printf '\033[1;31m[chaotic ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 # This script runs as the invoking user; sudo handles elevation for pacman
 # and pacman-key operations below.
 
+{{ if eq .os_family "arch" -}}
 if command -v paru >/dev/null 2>&1; then
     log "paru already installed — skipping chaotic setup"
     exit 0
 fi
 
-# Chaotic's official bootstrap. Run as root because pacman-key needs it.
+# Chaotic's official bootstrap.
 log "fetching chaotic key (3056513887B78AEB)"
-pacman-key --recv-key 3056513887B78AEB
-pacman-key --lsign-key 3056513887B78AEB
+sudo pacman-key --recv-key 3056513887B78AEB
+sudo pacman-key --lsign-key 3056513887B78AEB
 
 log "installing chaotic-keyring and chaotic-mirrorlist"
-pacman -U --noconfirm \
+sudo pacman -U --noconfirm \
     'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst' \
     'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'
 
 # Append chaotic repo to pacman.conf if not already present
-if ! grep -q "^\[chaotic-aur\]" /etc/pacman.conf; then
+if ! sudo grep -q "^\[chaotic-aur\]" /etc/pacman.conf; then
     log "appending chaotic-aur to /etc/pacman.conf"
-    cat >> /etc/pacman.conf <<'PACMAN_EOF'
+    sudo tee -a /etc/pacman.conf >/dev/null <<'PACMAN_EOF'
 
 [chaotic-aur]
 Include = /etc/pacman.d/chaotic-mirrorlist
@@ -45,10 +49,14 @@ else
 fi
 
 log "full system sync with chaotic enabled"
-pacman -Syu --noconfirm
+sudo pacman -Syu --noconfirm
 
 log "installing paru from chaotic-aur"
-pacman -S --needed --noconfirm paru
+sudo pacman -S --needed --noconfirm paru
 
 log "chaotic-aur + paru ready"
-paru --version
\ No newline at end of file
+paru --version
+{{ else -}}
+# Not an arch-base box — nothing to do.
+log "skipping chaotic-aur setup (os_family={{ .os_family }}, not arch)"
+{{ end -}}
\ No newline at end of file