diff --git a/modules/10-packages.sh b/modules/10-packages.sh
index 6ef2cda..ea93af2 100755
--- a/modules/10-packages.sh
+++ b/modules/10-packages.sh
@@ -78,24 +78,42 @@ _pkg_debian() {
   # rename packages: fd -> fdfind, bat -> batcat (fix via aliases in zsh)
   sudo_ apt-get install -y fdfind batcat 2>/dev/null || true
 
-  # eza via the gierens PPA (debs not in base apt)
+  # eza: the old apt.fury.io/gierens PPA is dead (401 Unauthorized). Install the
+  # single binary from the upstream GitHub release tarball into /usr/local/bin
+  # (system-wide — works for root and every sudo user; no HOME dependency).
   if ! command -v eza >/dev/null 2>&1; then
-    sudo_ install -m 0755 -d /etc/apt/keyrings
-    curl -fsSL https://raw.githubusercontent.com/eza-community/eza/main/deb.asc \
-      | sudo_ tee /etc/apt/keyrings/gierens.gpg >/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/gierens.gpg] http://apt.fury.io/eza/ /" \
-      | sudo_ tee /etc/apt/sources.list.d/eza.list >/dev/null
-    sudo_ apt-get update -y && sudo_ apt-get install -y eza || warn "eza PPA failed"
+    local eza_arch;  case "$ARCH" in
+      amd64) eza_arch=x86_64-unknown-linux-gnu ;;
+      arm64) eza_arch=aarch64-unknown-linux-gnu ;;
+      *)     eza_arch="${ARCH}-unknown-linux-gnu" ;;
+    esac
+    local url="https://github.com/eza-community/eza/releases/latest/download/eza_${eza_arch}.tar.gz"
+    local tmp; tmp="$(mktemp -d)"
+    if wget -qO "$tmp/eza.tgz" "$url" && tar xzf "$tmp/eza.tgz" -C "$tmp"; then
+      sudo_ install -m 0755 "$tmp/eza" /usr/local/bin/eza
+    else
+      warn "eza download failed ($url)"
+    fi
+    rm -rf "$tmp"
   fi
 
-  # starship: official installer
+  # starship: official installer. NOTE — scrub $ARCH/$PLATFORM from the env first:
+  # the installer reuses a pre-set ARCH (our lib/detect.sh exports ARCH=amd64) and
+  # skips its own amd64->x86_64 mapping, yielding an unsupported 'amd64-unknown-linux-
+  # musl' target ('builds for amd64-unknown-linux-musl are not yet available').
+  # Default bin dir is /usr/local/bin (system-wide).
   if ! command -v starship >/dev/null 2>&1; then
-    curl -sS https://starship.rs/install.sh | sh -s -- -y || warn "starship install failed"
+    curl -sS https://starship.rs/install.sh \
+      | env -u ARCH -u PLATFORM sh -s -- -y || warn "starship install failed"
   fi
 
-  # zoxide: official installer
+  # zoxide: official installer. Install system-wide (/usr/local/bin) instead of the
+  # default ~/.local/bin — when run as root the default lands in /root (wrong user
+  # for the create-user path) and isn't on $PATH; /usr/local/bin is on PATH for all.
   if ! command -v zoxide >/dev/null 2>&1; then
-    curl -sS https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | bash || warn "zoxide install failed"
+    curl -sS https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh \
+      | env -u ARCH sh -s -- --bin-dir /usr/local/bin --man-dir /usr/local/share/man \
+      || warn "zoxide install failed"
   fi
 
   # yq: direct binary from mikefarah/yq releases (stable URL)