diff --git a/modules/10-packages.sh b/modules/10-packages.sh
index ea93af2..420e5d5 100755
--- a/modules/10-packages.sh
+++ b/modules/10-packages.sh
@@ -81,6 +81,9 @@ _pkg_debian() {
   # eza: the old apt.fury.io/gierens PPA is dead (401 Unauthorized). Install the
   # single binary from the upstream GitHub release tarball into /usr/local/bin
   # (system-wide — works for root and every sudo user; no HOME dependency).
+  # Remove a stale eza.list left by the old (pre-fix) run that used the now-dead
+  # apt.fury.io PPA — otherwise 'apt-get update' keeps hitting the 401 forever.
+  sudo_ rm -f /etc/apt/sources.list.d/eza.list /etc/apt/keyrings/gierens.gpg
   if ! command -v eza >/dev/null 2>&1; then
     local eza_arch;  case "$ARCH" in
       amd64) eza_arch=x86_64-unknown-linux-gnu ;;
diff --git a/modules/25-angie.sh b/modules/25-angie.sh
index 314e19c..9906218 100755
--- a/modules/25-angie.sh
+++ b/modules/25-angie.sh
@@ -54,7 +54,11 @@ _angie_debian() {
   sudo_ install -m 0755 -d /etc/apt/keyrings
   curl -fsSL https://angie.software/keys/angie-signing.gpg \
     | sudo_ tee /etc/apt/keyrings/angie-signing.gpg >/dev/null
-  echo "deb [signed-by=/etc/apt/keyrings/angie-signing.gpg] https://download.angie.software/angie/${ID}/ ${VERSION_CODENAME} main" \
+  # Repo path is angie/<ID>/<VERSION_ID>/ with the codename as the apt suite, e.g.
+  # debian/13/dists/trixie/ or ubuntu/22.04/dists/jammy/. Omitting VERSION_ID (just
+  # angie/debian/) fetches debian/dists/trixie -> 404 'no Release file' — must pin the
+  # numeric version in the URL path.
+  echo "deb [signed-by=/etc/apt/keyrings/angie-signing.gpg] https://download.angie.software/angie/${ID}/${VERSION_ID}/ ${VERSION_CODENAME} main" \
     | sudo_ tee /etc/apt/sources.list.d/angie.list >/dev/null
   sudo_ apt-get update -y
   sudo_ apt-get install -y angie