diff --git a/install.sh b/install.sh
index 2ad84f6..47bb5a0 100755
--- a/install.sh
+++ b/install.sh
@@ -32,16 +32,28 @@ sys.exit(0 if sys.version_info >= (3, 10) else 1)
 PY
 ok "$(cd / && python3 -V)"
 
+# `import venv` succeeding proves nothing: Debian ships the venv module but
+# splits ensurepip into a separate package, and `python3 -m venv` then dies
+# with "ensurepip is not available" only after creating a half-built .venv.
+# Ask for ensurepip by name, before anything is written to disk.
+if ! (cd / && python3 -c "import ensurepip" 2>/dev/null); then
+  _pyver="$(cd / && python3 -c 'import sys;print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
+  die "python3 has the venv module but not ensurepip, so it cannot create a venv.
+  Debian/Ubuntu split this out. Install it and re-run:
+    sudo apt install python3.${_pyver#*.}-venv
+  (or: sudo apt install python3-venv)"
+fi
+ok "ensurepip present"
+
 # ---------------------------------------------------------------- venv
 
 say "Virtualenv + package"
 if [[ ! -x "$VENV/bin/python" ]]; then
+  # Python's own failure text names the exact missing package. Do not paper over
+  # it with a guess — say where to look and get out of the way.
   (cd / && python3 -m venv "$VENV") || die "could not create a venv at $VENV
-  Two things cause this. Read the traceback above to tell them apart:
-    - 'No module named venv'  -> the venv module is not installed.
-                                 Debian/Ubuntu: sudo apt install python3-venv
-    - anything else           -> report it; the installer already runs python
-                                 from / to keep this repo off sys.path."
+  Python printed the reason above; it is more specific than anything this
+  script could infer. A leftover half-built $VENV may need removing first."
   ok "created $VENV"
 else
   ok "reusing $VENV"