diff --git a/tools/install.sh b/tools/install.sh
index f6a29833..0d797d5c 100755
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -953,6 +953,39 @@ if [[ "$FLAG_CLI" == "true" ]]; then
   fi
 fi
 
+# ═══════════════════════════════════════════════════════════════════════════════
+# Post-install repair: link runtime assets again, now that the CLI exists
+# ═══════════════════════════════════════════════════════════════════════════════
+#
+# The framework's own install.sh ends by running `mosaic-link-runtime-assets`,
+# and that script asks the `mosaic` CLI whether lease enforcement can be
+# activated on this host before deciding whether to wire the #828 enforcement
+# hooks into settings.json. On a first install there is no CLI to ask — Part 1
+# runs before Part 2 — so it takes its fail-safe branch, prints a four-line
+# ERROR, and writes settings.json with the hooks stripped out.
+#
+# The result is that a greenfield host always ends up with enforcement
+# disabled, decided by the order the two halves install in rather than by
+# anything about the host. Measured on canary 1125, greenfield, both the
+# `--ref` and `--next` lanes.
+#
+# Running it once more here lets the guard reach its real verdict. The script
+# is idempotent — unchanged files are skipped — so on an upgrade, where the CLI
+# was already present and the first pass already succeeded, this is a no-op.
+# No `--allow-inactive-enforcement`: Part 1 does not pass it either, and this
+# pass must not be more permissive than the one it is correcting.
+if [[ "$FLAG_CHECK" == "false" && "$FLAG_FRAMEWORK" == "true" && "$FLAG_CLI" == "true" ]]; then
+  RELINK_SCRIPT="$MOSAIC_HOME/tools/_scripts/mosaic-link-runtime-assets"
+  if [[ -x "$RELINK_SCRIPT" && -x "$PREFIX/bin/mosaic" ]]; then
+    step "Runtime assets (re-check with CLI present)"
+    if PATH="$PREFIX/bin:$PATH" "$RELINK_SCRIPT" >/dev/null; then
+      ok "Runtime assets linked"
+    else
+      warn "Runtime asset linking is still degraded — see message above."
+    fi
+  fi
+fi
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # Summary
 # ═══════════════════════════════════════════════════════════════════════════════