diff --git a/.gitea/workflows/deb.yml b/.gitea/workflows/deb.yml
index 078b4e07..0d7e6eb7 100644
--- a/.gitea/workflows/deb.yml
+++ b/.gitea/workflows/deb.yml
@@ -110,10 +110,15 @@ jobs:
           PUNKTFUNK_BUILD_VERSION: ${{ env.VERSION }}   # stamped into the binaries (build.rs)
         run: |
           git config --global --add safe.directory "$PWD"
-          # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect —
-          # both client binaries must ship (build-client-deb.sh installs both). The HOST is built
-          # separately in the build-publish-host job (Ubuntu 24.04 image + bundled FFmpeg 8).
-          cargo build --release --locked -p punktfunk-client-linux -p punktfunk-client-session
+          # THREE binaries ship in the client .deb, so all three are built here: the GTK shell,
+          # punktfunk-client-session (the Vulkan/Skia streamer the shell execs for a connect), and
+          # punktfunk-cli (the headless `punktfunk` front-end). build-client-deb.sh installs all
+          # three; leaving punktfunk-cli out here made it fall over on `install: No such file or
+          # directory`, because its build-if-missing guard only tested the first two and so decided
+          # everything was already built. The HOST is built separately in the build-publish-host
+          # job (Ubuntu 24.04 image + bundled FFmpeg 8).
+          cargo build --release --locked \
+            -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-cli
 
       - name: Build + smoke-boot web console (bun preset)
         # Gate the .deb on a real bun boot: the punktfunk-web .deb runs the Nitro `bun` preset
diff --git a/packaging/debian/build-client-deb.sh b/packaging/debian/build-client-deb.sh
index 1c911b84..963cba0e 100644
--- a/packaging/debian/build-client-deb.sh
+++ b/packaging/debian/build-client-deb.sh
@@ -40,8 +40,13 @@ BIN="$OUTDIR/$PKG"
 SESSION_BIN="$OUTDIR/punktfunk-session"
 # The headless CLI (design/client-architecture-split.md §4) ships with every client.
 CLI_BIN="$OUTDIR/punktfunk"
-if [ ! -x "$BIN" ] || [ ! -x "$SESSION_BIN" ]; then
-  echo "==> building $CRATE + punktfunk-client-session (release${TARGET:+ for $TARGET})"
+# Test every binary this script goes on to install, not a subset. It used to check only $BIN and
+# $SESSION_BIN while installing three, so a caller that pre-built exactly those two (deb.yml did)
+# satisfied the guard, skipped this build, and then died on `install: No such file or directory`
+# for $CLI_BIN — a confusing way to say "the CLI was never built". The arm64 leg never hit it
+# because it pre-builds nothing, so the guard always fired there and built all three.
+if [ ! -x "$BIN" ] || [ ! -x "$SESSION_BIN" ] || [ ! -x "$CLI_BIN" ]; then
+  echo "==> building $CRATE + punktfunk-client-session + punktfunk-cli (release${TARGET:+ for $TARGET})"
   cargo build --release --locked "${CARGO_TARGET_ARGS[@]}" -p "$CRATE" -p punktfunk-client-session -p punktfunk-cli
 fi