diff --git a/install.sh b/install.sh
index 35fd5c4..2ad84f6 100755
--- a/install.sh
+++ b/install.sh
@@ -62,9 +62,28 @@ ok "console scripts: socialmag, socialmag-refresh, socialmag-openbridge"
 # ---------------------------------------------------------------- systemd
 
 say "systemd user units"
-if ! command -v systemctl >/dev/null 2>&1; then
-  warn "systemctl not found — skipping units"
-  warn "run the three processes by hand: socialmag, socialmag-openbridge, and 'python -m http.server 8321' in $REPO"
+# systemctl being installed does NOT mean a user bus is reachable. Inside an LXC,
+# over `su`, or on a box with no logind session, `systemctl --user` fails with
+# "Failed to connect to user scope bus". Ask the real question — can we talk to
+# the user manager — instead of asking whether the binary exists.
+USER_BUS=""
+if command -v systemctl >/dev/null 2>&1 && systemctl --user show-environment >/dev/null 2>&1; then
+  USER_BUS="yes"
+fi
+
+if [[ -z "$USER_BUS" ]]; then
+  warn "no reachable systemd user bus — units NOT installed."
+  if ! command -v systemctl >/dev/null 2>&1; then
+    warn "reason: systemctl is not on PATH."
+  else
+    warn "reason: systemctl --user cannot reach a user manager (XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-unset})."
+    warn "common causes: an LXC without logind, a shell entered via su, or no lingering."
+    warn "  sudo loginctl enable-linger $USER   # then log in fresh and re-run"
+  fi
+  warn "until then, run the three by hand from $REPO:"
+  warn "  $VENV/bin/socialmag-openbridge &"
+  warn "  $VENV/bin/python -m http.server 8321 &"
+  warn "  $VENV/bin/socialmag-refresh           # one pass, whenever you want it"
 else
   mkdir -p "$UNIT_DIR"
   for src in "$REPO"/deploy/user/*.in; do
@@ -94,7 +113,23 @@ fi
 # ---------------------------------------------------------------- hermes
 
 say "Hermes MCP registration"
-HERMES_PY="/usr/local/lib/hermes-agent/venv/bin/python"
+
+# Hermes installs in more than one shape — /usr/local/bin/hermes wrapping a venv
+# under /usr/local/lib, or ~/.local/bin/hermes from a user install. Read the
+# interpreter out of the wrapper rather than hardcoding one box's layout.
+HERMES_PY=""
+if command -v hermes >/dev/null 2>&1; then
+  _hermes_bin="$(command -v hermes)"
+  if head -c 2 "$_hermes_bin" 2>/dev/null | grep -q '#!'; then
+    # A wrapper script: the python it exec's is the interpreter that loads MCP.
+    HERMES_PY="$(grep -oE '"[^"]*/bin/python[0-9.]*"|[^ "]*/bin/python[0-9.]*' "$_hermes_bin" 2>/dev/null | head -1 | tr -d '"')"
+  fi
+  # A console script generated by pip: its own shebang names the interpreter.
+  if [[ -z "$HERMES_PY" ]]; then
+    _shebang="$(head -1 "$_hermes_bin" 2>/dev/null)"
+    [[ "$_shebang" == '#!'*python* ]] && HERMES_PY="${_shebang#\#!}"
+  fi
+fi
 
 if ! command -v hermes >/dev/null 2>&1; then
   warn "hermes not on PATH — skipping. Register manually later:"
@@ -157,8 +192,27 @@ $(printf '\033[1;32mInstalled.\033[0m') Two things left, both yours:
 
 Then:
 
+EOF
+
+# Only name the dashboard and the journal when units actually got installed.
+# Pointing someone at `journalctl --user -u socialmag-refresh` for a unit that
+# was never created is the same class of lie as a silent fallback: it reads as
+# working and answers with nothing.
+if [[ -n "$USER_BUS" ]]; then
+  cat <<EOF
   dashboard   http://127.0.0.1:8321/dashboard.html
   check       $VENV/bin/socialmag-refresh
   logs        journalctl --user -u socialmag-refresh -f
 
 EOF
+else
+  cat <<EOF
+  check       $VENV/bin/socialmag-refresh
+  dashboard   start the file server yourself (see the warnings above), then
+              http://127.0.0.1:8321/dashboard.html
+
+  No units were installed, so nothing refreshes on a timer yet and there is no
+  journal to read. Fix the user bus above and re-run to get those.
+
+EOF
+fi