diff --git a/module/scripts/common.sh b/module/scripts/common.sh
index 241d6ec..ae6a855 100755
--- a/module/scripts/common.sh
+++ b/module/scripts/common.sh
@@ -39,13 +39,20 @@ install_apk() {
   src="$1"
   [ -s "$src" ] || return 1
   stage="/data/local/tmp/betterflow-install-$$.apk"
+  error_log="$DATA_DIR/install-error.log"
   rm -f "$stage"
   cp -f "$src" "$stage" || return 1
   chmod 0644 "$stage" 2>/dev/null || true
-  if pm install -r "$stage" >/dev/null 2>&1; then
+  restorecon "$stage" >/dev/null 2>&1 || true
+  output=$(pm install --user 0 -r "$stage" 2>&1)
+  result=$?
+  if [ "$result" -eq 0 ]; then
     rm -f "$stage"
+    rm -f "$error_log"
     return 0
   fi
+  printf '%s\n' "$output" > "$error_log"
+  printf '%s\n' "$output" >&2
   rm -f "$stage"
   return 1
 }
diff --git a/module/scripts/hot-update.sh b/module/scripts/hot-update.sh
index 516e080..0dee763 100755
--- a/module/scripts/hot-update.sh
+++ b/module/scripts/hot-update.sh
@@ -50,6 +50,18 @@ bb unzip -oq "$ZIP" -d "$TMP/unpack" || { say "betterFlow: unzip failed"; exit 1
 APK="$TMP/unpack/app/betterflow.apk"
 [ -s "$APK" ] || { say "betterFlow: release has no APK"; exit 1; }
 
+# Refresh the updater itself before installing the APK. This deliberately
+# happens after SHA-256 verification and lets a corrected installer recover on
+# the next Action run even if this APK installation fails.
+if [ -d "$TMP/unpack/module-runtime/scripts" ]; then
+  for script in common.sh hot-update.sh; do
+    [ -s "$TMP/unpack/module-runtime/scripts/$script" ] || continue
+    cp -f "$TMP/unpack/module-runtime/scripts/$script" "$MODDIR/scripts/$script.new" || continue
+    chmod 0755 "$MODDIR/scripts/$script.new"
+    mv -f "$MODDIR/scripts/$script.new" "$MODDIR/scripts/$script"
+  done
+fi
+
 OLD_APK="$DATA_DIR/backups/betterflow-prev.apk"
 if [ -s "$DATA_DIR/current.apk" ]; then cp -f "$DATA_DIR/current.apk" "$OLD_APK"; fi
 cp -f "$APK" "$DATA_DIR/current.apk.new"
@@ -63,9 +75,9 @@ if ! install_apk "$DATA_DIR/current.apk.new"; then
 fi
 mv -f "$DATA_DIR/current.apk.new" "$DATA_DIR/current.apk"
 
-# Script payloads are intentionally replaced only after the APK has installed.
+# Refresh the remaining runtime scripts after the APK has installed.
 if [ -d "$TMP/unpack/module-runtime/scripts" ]; then
-  for script in common.sh watchdog.sh status.sh control.sh; do
+  for script in watchdog.sh status.sh control.sh; do
     [ -s "$TMP/unpack/module-runtime/scripts/$script" ] || continue
     cp -f "$TMP/unpack/module-runtime/scripts/$script" "$MODDIR/scripts/$script.new" || continue
     chmod 0755 "$MODDIR/scripts/$script.new"
diff --git a/tools/package-release.sh b/tools/package-release.sh
index f99ebba..eeb9d34 100755
--- a/tools/package-release.sh
+++ b/tools/package-release.sh
@@ -16,7 +16,7 @@ cp -a webui/dist/. "$OUT/module/webroot/"
 cp "$APK" "$OUT/module/payload/betterflow.apk"
 cp "$APK" "$OUT/runtime/app/betterflow.apk"
 
-for script in common.sh watchdog.sh status.sh control.sh; do
+for script in common.sh hot-update.sh watchdog.sh status.sh control.sh; do
   cp "module/scripts/$script" "$OUT/runtime/module-runtime/scripts/$script"
 done
 cp -a webui/dist/. "$OUT/runtime/module-runtime/webroot/"