diff --git a/Makefile b/Makefile
index 0fb720a..71b0b73 100644
--- a/Makefile
+++ b/Makefile
@@ -70,12 +70,14 @@ tidy:
 
 ui:
 	@echo "  -> management-ui (vite build, version $(VERSION))"
-	@cd management-ui && npm run build
+	@cd management-ui && \
+	    if [ -x "$$(command -v bun)" ]; then bun install --silent && bun run build; \
+	    else npm install --silent && npm run build; fi
 
-deb-amd64: build-linux-amd64
+deb-amd64: build-linux-amd64 ui
 	@./scripts/apt-repo/build-package.sh amd64 $(VERSION)
 
-deb-arm64: build-linux-arm64
+deb-arm64: build-linux-arm64 ui
 	@./scripts/apt-repo/build-package.sh arm64 $(VERSION)
 
 deb: deb-amd64 deb-arm64
diff --git a/deploy/systemd/edgeguard-api.service b/deploy/systemd/edgeguard-api.service
index b4d1a2a..3686907 100644
--- a/deploy/systemd/edgeguard-api.service
+++ b/deploy/systemd/edgeguard-api.service
@@ -13,7 +13,7 @@ ExecStart=/usr/bin/edgeguard-api
 Restart=on-failure
 RestartSec=5
 
-# Hardening — API needs to shell out to `sudo systemctl reload haproxy/angie/squid`
+# Hardening — API needs to shell out to `sudo systemctl reload haproxy/squid`
 # after writing configs. Sandboxing stays strict around fs/net.
 NoNewPrivileges=false
 ProtectSystem=strict