diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index 62c1208c..1ffbffad 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -195,10 +195,16 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Verify the release exists before uploading (workflow_dispatch may not have one)
-          if ! gh release view "${{ steps.tag.outputs.tag }}" >/dev/null 2>&1; then
-            echo "[!] No GitHub Release found for tag ${{ steps.tag.outputs.tag }}, skipping upload."
+          TAG="${{ steps.tag.outputs.tag }}"
+          # Verify the release exists before uploading
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            echo "[!] No GitHub Release found for tag $TAG."
+            if [ -n "${{ github.event.release.tag_name }}" ]; then
+              echo "[X] This was triggered by a release event — the release should exist. Failing."
+              exit 1
+            fi
+            echo "[i] Skipping upload (workflow_dispatch without a release)."
             echo "    Create a release first or trigger via the release event."
             exit 0
           fi
-          gh release upload "${{ steps.tag.outputs.tag }}" *.deb --clobber
+          gh release upload "$TAG" *.deb --clobber
diff --git a/.github/workflows/homebrew.yml b/.github/workflows/homebrew.yml
index 9ef0c9a3..79ecf6e8 100644
--- a/.github/workflows/homebrew.yml
+++ b/.github/workflows/homebrew.yml
@@ -94,6 +94,13 @@ ${RESOURCES}
     virtualenv_install_with_resources
   end
 
+  def post_install
+    data_dir = var/"archivebox"
+    data_dir.mkpath
+    ENV["DATA_DIR"] = data_dir.to_s
+    system bin/"archivebox", "init"
+  end
+
   test do
     assert_match version.to_s, shell_output("#{bin}/archivebox version")
   end
diff --git a/bin/build_brew.sh b/bin/build_brew.sh
index e6bf8a45..d94b13ca 100755
--- a/bin/build_brew.sh
+++ b/bin/build_brew.sh
@@ -80,6 +80,14 @@ ${RESOURCES}
     virtualenv_install_with_resources
   end
 
+  def post_install
+    # Initialize ArchiveBox data in the Homebrew-managed var directory
+    data_dir = var/"archivebox"
+    data_dir.mkpath
+    ENV["DATA_DIR"] = data_dir.to_s
+    system bin/"archivebox", "init"
+  end
+
   test do
     assert_match version.to_s, shell_output("#{bin}/archivebox version")
   end
diff --git a/brew_dist/archivebox.rb b/brew_dist/archivebox.rb
index f25dd8e6..5eb56de8 100644
--- a/brew_dist/archivebox.rb
+++ b/brew_dist/archivebox.rb
@@ -23,6 +23,14 @@ class Archivebox < Formula
     virtualenv_install_with_resources
   end
 
+  def post_install
+    # Initialize ArchiveBox data in the Homebrew-managed var directory
+    data_dir = var/"archivebox"
+    data_dir.mkpath
+    ENV["DATA_DIR"] = data_dir.to_s
+    system bin/"archivebox", "init"
+  end
+
   test do
     assert_match version.to_s, shell_output("#{bin}/archivebox version")
   end
diff --git a/pkg/debian/scripts/preremove.sh b/pkg/debian/scripts/preremove.sh
index 6d48ab24..65fc7330 100755
--- a/pkg/debian/scripts/preremove.sh
+++ b/pkg/debian/scripts/preremove.sh
@@ -2,13 +2,17 @@
 # preremove script for archivebox .deb package
 set -e
 
-# Only clean up on full removal, not during upgrade.
-# dpkg passes "$1" as "remove", "purge", or "upgrade" — we skip cleanup on
-# upgrade so the venv and service persist across package version bumps.
+# dpkg passes "$1" as "remove", "purge", or "upgrade".
+
+# Always stop the service before removing or upgrading, because postinstall
+# replaces the venv in-place — the running process would use stale binaries.
+if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
+    systemctl stop archivebox 2>/dev/null || true
+fi
+
+# Only disable + clean up on full removal, not during upgrade.
 if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
-    # Stop the service if running
     if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
-        systemctl stop archivebox 2>/dev/null || true
         systemctl disable archivebox 2>/dev/null || true
     fi