diff --git a/bin/install.sh b/bin/install.sh
index 0161e7c..e86c741 100755
--- a/bin/install.sh
+++ b/bin/install.sh
@@ -189,24 +189,48 @@ install_terragrunt() {
   mark_version terragrunt "$ver"
 }
 
-install_jq
-install_kubectl
-install_helm
-install_k9s
+# try <install_fn> — run one tool's installer; on failure, warn and keep going.
+#
+# WHY: these installs used to be bare calls, so under `set -eu` the FIRST
+# failure killed this script -- and its non-zero exit then aborted bootstrap.sh
+# itself, so every later module (node/, ansible/) silently never ran. A single
+# tool whose release asset moved could leave a box with no opencode, no npx and
+# no python3. One optional CLI is not worth the whole bootstrap.
+#
+# The subshell re-enables `set -e` inside itself (it is disabled for a command
+# being tested by `if`), so a failed download still aborts that tool's function
+# before mark_version stamps a version that was never installed.
+FAILED=""
+try() {
+  if ( set -e; "$1" ); then return 0; fi
+  FAILED="$FAILED ${1#install_}"
+  fsay "WARNING: ${1#install_} failed to install; continuing."
+}
+
+try install_jq
+try install_kubectl
+try install_helm
+try install_k9s
 if docker_full_available; then
-  install_kind
+  try install_kind
 else
   fsay "Skipping kind: full (non-rootless) Docker not available."
 fi
-install_kubectx
-install_kubens
-install_stern
-install_yq
-install_tofu
-install_task
-install_terragrunt
-install_1p
-install_opencode
-install_zarf
+try install_kubectx
+try install_kubens
+try install_stern
+try install_yq
+try install_tofu
+try install_task
+try install_terragrunt
+try install_1p
+try install_opencode
+try install_zarf
 
-fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."
+if [ -n "$FAILED" ]; then
+  fsay ""
+  fsay "WARNING: these tools did NOT install:$FAILED"
+  fsay "Everything else is in $BIN_DIR. Fix the cause and re-run bin/install.sh."
+else
+  fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."
+fi
diff --git a/bootstrap.sh b/bootstrap.sh
index 035fc5e..cc4f207 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -29,6 +29,20 @@ if [ ! -f "$SCRIPT_DIR/zsh/install.sh" ]; then
   exec "$DOTFILES_DIR/bootstrap.sh"
 fi
 
+# python3 is a hard dependency of this setup, not an optional extra:
+#   - lib/fetch.sh needs python3 (or unzip) to extract .zip release assets;
+#     without either, the 1Password CLI install fails.
+#   - mcp-config/sync.sh needs it to inject the gateway's discovered models;
+#     without it opencode comes up with an EMPTY model list.
+# Minimal Debian/RHEL images ship neither python3 nor unzip, so install it
+# before bin/ runs. Non-fatal: an unsupported OS should degrade, not abort.
+if ! command -v python3 >/dev/null 2>&1 && ! command -v unzip >/dev/null 2>&1; then
+  # shellcheck source=lib/os-detect.sh
+  . "$SCRIPT_DIR/lib/os-detect.sh"
+  echo "bootstrap: installing python3 (needed for zip assets and model discovery)"
+  pkg_install python3 || echo "bootstrap: warning: could not install python3" >&2
+fi
+
 "$SCRIPT_DIR/zsh/install.sh"
 "$SCRIPT_DIR/git/install.sh"
 # Runs before bin/ so the kind install gate can see the rootful daemon.