diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index 04979adf..5fe29d94 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -112,9 +112,13 @@ jobs:
 
       - name: Pre-seed virtualenv with local wheel before dpkg install
         run: |
-          # Create the venv and install from local wheel BEFORE dpkg runs postinstall.
-          # This way the postinstall's pip install either succeeds (release) or
-          # finds archivebox already installed (CI) and just upgrades deps.
+          # CI-only: pre-seed the venv with a local wheel so we test the
+          # unreleased code, not whatever is on PyPI. We explicitly use python3.13
+          # here (matching the system dep installed above) to ensure the venv is
+          # created with the correct Python version. On real installs, install.sh
+          # handles this by preferring python3.13 and failing if < 3.13.
+          # When postinstall.sh runs during dpkg -i, it finds the venv already
+          # populated and just upgrades deps.
           sudo mkdir -p /opt/archivebox
           sudo python3.13 -m venv /opt/archivebox/venv
           sudo /opt/archivebox/venv/bin/python3 -m pip install --quiet --upgrade pip setuptools
@@ -167,6 +171,22 @@ jobs:
       contents: write
 
     steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Determine release tag
+        id: tag
+        run: |
+          # github.event.release.tag_name is set for release events but empty
+          # for workflow_dispatch. Fall back to the version from pyproject.toml.
+          TAG="${{ github.event.release.tag_name }}"
+          if [ -z "$TAG" ]; then
+            TAG="v$(grep '^version = ' pyproject.toml | awk -F'\"' '{print $2}')"
+            echo "[i] No release tag in event context, using version from pyproject.toml: $TAG"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
       - name: Download all .deb artifacts
         uses: actions/download-artifact@v4
         with:
@@ -177,4 +197,4 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "${{ github.event.release.tag_name }}" *.deb --clobber
+          gh release upload "${{ steps.tag.outputs.tag }}" *.deb --clobber
diff --git a/pkg/debian/archivebox.service b/pkg/debian/archivebox.service
index b3fe89ad..af8b4500 100644
--- a/pkg/debian/archivebox.service
+++ b/pkg/debian/archivebox.service
@@ -10,8 +10,9 @@ Type=simple
 User=archivebox
 Group=archivebox
 WorkingDirectory=/var/lib/archivebox
-ExecStartPre=/opt/archivebox/venv/bin/archivebox init
-ExecStart=/opt/archivebox/venv/bin/archivebox server 0.0.0.0:8000
+Environment="PATH=/opt/archivebox/venv/bin:/usr/local/bin:/usr/bin:/bin"
+ExecStartPre=/usr/bin/archivebox init
+ExecStart=/usr/bin/archivebox server 0.0.0.0:8000
 Restart=on-failure
 RestartSec=5
 
diff --git a/pkg/debian/install.sh b/pkg/debian/install.sh
index 0f0e11d2..44d58c4e 100755
--- a/pkg/debian/install.sh
+++ b/pkg/debian/install.sh
@@ -7,22 +7,41 @@ set -e
 ARCHIVEBOX_VENV="/opt/archivebox/venv"
 ARCHIVEBOX_VERSION="${ARCHIVEBOX_VERSION:-}"
 
-echo "[+] Setting up ArchiveBox virtualenv in $ARCHIVEBOX_VENV..."
+# ArchiveBox requires Python >= 3.13 (per pyproject.toml).
+# Prefer python3.13 explicitly; fall back to python3 with a version check.
+if command -v python3.13 >/dev/null 2>&1; then
+    PYTHON="python3.13"
+elif command -v python3 >/dev/null 2>&1; then
+    PYTHON="python3"
+    PY_VER="$("$PYTHON" -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
+    if [ "$(echo "$PY_VER 3.13" | awk '{print ($1 >= $2)}')" != "1" ]; then
+        echo "[!] Error: ArchiveBox requires Python >= 3.13, but found Python $PY_VER"
+        echo "    Install python3.13: sudo apt install python3.13 python3.13-venv"
+        exit 1
+    fi
+else
+    echo "[!] Error: python3 not found. Install python3.13: sudo apt install python3.13 python3.13-venv"
+    exit 1
+fi
+
+echo "[+] Setting up ArchiveBox virtualenv in $ARCHIVEBOX_VENV (using $PYTHON)..."
 
 # Create the virtualenv if it doesn't exist
 if [ ! -d "$ARCHIVEBOX_VENV" ]; then
-    python3 -m venv "$ARCHIVEBOX_VENV"
+    "$PYTHON" -m venv "$ARCHIVEBOX_VENV"
 fi
 
 # Upgrade pip inside the virtualenv
 "$ARCHIVEBOX_VENV/bin/python3" -m pip install --quiet --upgrade pip setuptools
 
-# Install or upgrade archivebox (pinned to .deb version if set)
+# Install or upgrade archivebox.
+# ARCHIVEBOX_VERSION is set by postinstall.sh from the .deb package version.
+# When run manually without it, install the latest release from PyPI.
 if [ -n "$ARCHIVEBOX_VERSION" ]; then
     echo "[+] Installing archivebox==$ARCHIVEBOX_VERSION..."
     "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade "archivebox==$ARCHIVEBOX_VERSION"
 else
-    echo "[+] Installing latest archivebox..."
+    echo "[+] Installing latest archivebox (no version pinned)..."
     "$ARCHIVEBOX_VENV/bin/pip" install --quiet --upgrade archivebox
 fi
 
diff --git a/pkg/debian/nfpm.yaml b/pkg/debian/nfpm.yaml
index 0e592af1..64accf7f 100644
--- a/pkg/debian/nfpm.yaml
+++ b/pkg/debian/nfpm.yaml
@@ -19,8 +19,9 @@ section: "web"
 priority: "optional"
 
 depends:
-  # python3 >= 3.11 allows .deb to install on more systems;
-  # pip enforces the actual Python version requirement from pyproject.toml
+  # python3 >= 3.11 allows dpkg to install on more systems (e.g. Ubuntu 24.04).
+  # install.sh enforces the real >= 3.13 requirement at venv creation time,
+  # failing early with a clear error if only an older python3 is available.
   - python3 (>= 3.11)
   - python3-pip
   - python3-venv