diff --git a/flake.nix b/flake.nix
index 4ec9527..4ab7407 100644
--- a/flake.nix
+++ b/flake.nix
@@ -199,7 +199,7 @@
           inherit system;
           modules = [
             (nixpkgs + "/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix")
-            ({ pkgs, ... }: {
+            ({ pkgs, lib, ... }: {
               services.openssh.enable = true;
               services.openssh.settings.PermitRootLogin = "prohibit-password";
               users.users.root.openssh.authorizedKeys.keys = [
@@ -265,15 +265,25 @@
                 after = [ "homelab-checkout.service" ];
                 requires = [ "homelab-checkout.service" ];
                 wantedBy = [ "multi-user.target" ];
-                path = [ pkgs.gnugrep pkgs.gnused pkgs.util-linux pkgs.coreutils pkgs.git pkgs.efibootmgr ];
                 serviceConfig.Type = "oneshot";
-                # systemd does NOT set $HOME for a system service without User=
-                # (systemd.exec(5): SetLoginEnvironment= "defaults to true if
-                # User=, DynamicUser= or PAMName= are set, false otherwise"), and
-                # scripts/deploy runs under `set -u`. Without this the whole
-                # unattended run died on the bare $HOME expansion with an
-                # "unbound variable" that reads like a bug in the script.
-                serviceConfig.Environment = "HOME=/root";
+                # Full system PATH, not the restricted default a `path = [...]`
+                # produces: this unit execs `./scripts/deploy`, whose
+                # `#!/usr/bin/env bash` needs bash, and which then reaches for
+                # nix / nixos-install / git / sudo / efibootmgr. The default
+                # service PATH gave "env: 'bash': No such file or directory"
+                # (status 127) before the script even started.
+                # /run/current-system/sw/bin carries all of it on the installer;
+                # /run/wrappers/bin for sudo. mkForce because NixOS otherwise
+                # derives environment.PATH from `path` and that line would win.
+                #
+                # HOME too: systemd sets no $HOME for a service without User=
+                # (systemd.exec(5): SetLoginEnvironment= defaults false), and
+                # scripts/deploy runs under `set -u`, so a bare $HOME aborted the
+                # whole run with an "unbound variable" that read like a bug.
+                environment = {
+                  HOME = "/root";
+                  PATH = lib.mkForce "/run/current-system/sw/bin:/run/wrappers/bin";
+                };
                 script = ''
                   cfg=$(grep -o 'homelab\.install=[^ ]*' /proc/cmdline | cut -d= -f2 || true)
                   if [ -z "$cfg" ]; then