diff --git a/lib/API.txt b/lib/API.txt
index 72ab86c..5ff83af 100644
--- a/lib/API.txt
+++ b/lib/API.txt
@@ -4,6 +4,7 @@ _configure_pg_cron_preload
 _cs_apt_install_optional
 _cs_clean_target_dir
 _cs_drop_pm_shim
+_cs_repair_dpkg
 _cs_write_cargo_profile
 _deploy_source_tarball
 _deploy_unpacked_archive
diff --git a/lib/forge.func b/lib/forge.func
index ef63cf8..8b97784 100644
--- a/lib/forge.func
+++ b/lib/forge.func
@@ -1962,6 +1962,7 @@ fetch_and_deploy_release() {
     DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
       SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        _cs_repair_dpkg
         return 100
       }
     }
@@ -2164,6 +2165,7 @@ fetch_and_deploy_from_url() {
     $STD apt install -y "$tmpdir/$filename" || {
       $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        _cs_repair_dpkg
         return 100
       }
     }
diff --git a/lib/hwaccel.func b/lib/hwaccel.func
index 9dff67d..a2b384a 100644
--- a/lib/hwaccel.func
+++ b/lib/hwaccel.func
@@ -23,11 +23,18 @@ _cs_apt_install_optional() {
   (($#)) || return 0
   $STD apt -y install "$@" 2>/dev/null && return 0
 
-  local missed=() pkg
+  local missed=() failed=() pkg
   for pkg in "$@"; do
-    $STD apt -y install "$pkg" 2>/dev/null || missed+=("$pkg")
+    $STD apt -y install "$pkg" 2>/dev/null && continue
+    # A broken apt state fails every install, which is not the same thing.
+    if apt-cache policy "$pkg" 2>/dev/null | grep -q "Candidate: (none)"; then
+      missed+=("$pkg")
+    else
+      failed+=("$pkg")
+    fi
   done
   ((${#missed[@]})) && msg_warn "Not available on this release: ${missed[*]}"
+  ((${#failed[@]})) && msg_warn "In the repository but would not install: ${failed[*]} - apt may be in a broken state"
   return 0
 }
 
@@ -382,6 +389,9 @@ _setup_intel_arc() {
     if [[ "$os_codename" == "trixie" || "$os_codename" == "sid" ]]; then
       msg_info "Fetching Intel compute-runtime from GitHub for Arc support"
 
+      # intel-opencl-icd declares it; dpkg refuses the package without it.
+      _cs_apt_install_optional ocl-icd-libopencl1
+
       # Fetch a compute-runtime package first so TOOLS_GH_REL_JSON is populated,
       # then resolve the matching IGC tag from the release notes.
       # libigdgmm - bundled in compute-runtime releases
@@ -433,6 +443,9 @@ _setup_intel_modern() {
     if [[ "$os_codename" == "trixie" || "$os_codename" == "sid" ]]; then
       msg_info "Fetching Intel compute-runtime from GitHub"
 
+      # intel-opencl-icd declares it; dpkg refuses the package without it.
+      _cs_apt_install_optional ocl-icd-libopencl1
+
       # Fetch a compute-runtime package first so TOOLS_GH_REL_JSON is populated,
       # then resolve the matching IGC tag from the release notes.
       # libigdgmm first (bundled in compute-runtime releases)
diff --git a/lib/system.func b/lib/system.func
index 143efee..5b394dc 100644
--- a/lib/system.func
+++ b/lib/system.func
@@ -2283,6 +2283,11 @@ curl_download() {
 # Usage: _diagnose_deb_failure "/path/to/file.deb"
 # Returns: always 0 (diagnostic only — caller must return the error code)
 # ------------------------------------------------------------------------------
+# A failed .deb leaves dpkg half-configured, which breaks every later apt call.
+_cs_repair_dpkg() {
+  $STD dpkg --configure -a 2>/dev/null || true
+  DEBIAN_FRONTEND=noninteractive $STD apt-get -y --fix-broken install 2>/dev/null || true
+}
 _diagnose_deb_failure() {
   local deb_path="$1"
   local filename="${deb_path##*/}"