diff --git a/run_once_20-install-user-packages.sh.tmpl b/run_once_20-install-user-packages.sh.tmpl
index 972e6d1..c220039 100755
--- a/run_once_20-install-user-packages.sh.tmpl
+++ b/run_once_20-install-user-packages.sh.tmpl
@@ -43,7 +43,7 @@ sudo apt-get upgrade -y
 
 APT_PKGS=(
     zsh tmux git build-essential
-    bat btop htop fastfetch
+    btop htop fastfetch
     eza fzf fd-find ripgrep zoxide starship
     lazygit yt-dlp jq
     unzip p7zip
@@ -62,12 +62,13 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
     ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
 fi
 
-# Same treatment for 'bat' (renamed to 'batcat' on Debian to avoid clashing
-# with a different unrelated package). .zshrc aliases assume 'bat'.
-if command -v batcat >/dev/null 2>&1 && ! command -v bat >/dev/null 2>&1; then
-    log "symlinking batcat -> bat in ~/.local/bin"
-    mkdir -p "$USER_HOME/.local/bin"
-    ln -sf "$(command -v batcat)" "$USER_HOME/.local/bin/bat"
+# Debian ships 'bat' as 'batcat' due to a name clash with an unrelated
+# package. Install upstream 'bat' via cargo so we get the real binary at
+# $HOME/.cargo/bin/bat. Faster than apt's renamed package, version-aligned
+# with arch's pacman install.
+if command -v cargo >/dev/null 2>&1 && ! command -v bat >/dev/null 2>&1; then
+    log "installing bat via cargo (upstream, debian renames it to batcat)"
+    cargo install bat --locked 2>&1 | tail -5
 fi
 
 # Neovim — install official binary tarball, pinned to a known-good version.