diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
index f0a426a..fbc4204 100644
--- a/packaging/nfpm.yaml
+++ b/packaging/nfpm.yaml
@@ -54,6 +54,16 @@ contents:
     file_info:
       mode: 0644
 
+  # Ubuntu/Debian's ydotool & ydotoold packages ship the binaries but not a
+  # systemd unit, so the drop-in above has nothing to drop into. Ship a base
+  # ydotool.service ourselves on deb only — Fedora's ydotool package already
+  # provides one (we'd conflict if we shipped it on rpm too).
+  - src: ./systemd/ydotool.service
+    dst: /usr/lib/systemd/system/ydotool.service
+    file_info:
+      mode: 0644
+    packager: deb
+
   - src: ../scripts/download-model.sh
     dst: /usr/share/utter/download-model.sh
     file_info:
@@ -80,6 +90,7 @@ overrides:
   deb:
     depends:
       - ydotool
+      - ydotoold
       - alsa-utils
       - wl-clipboard
       - libnotify-bin
diff --git a/packaging/scripts/postinstall.sh b/packaging/scripts/postinstall.sh
index 6fab277..cf5d638 100755
--- a/packaging/scripts/postinstall.sh
+++ b/packaging/scripts/postinstall.sh
@@ -6,7 +6,28 @@ set -e
 # get added after install.
 if command -v udevadm >/dev/null 2>&1; then
     udevadm control --reload-rules || true
-    udevadm trigger --subsystem-match=input || true
+    # `change` action so logind re-evaluates ACLs on already-plugged devices
+    # rather than only firing for new device adds.
+    udevadm trigger --subsystem-match=input --action=change || true
+fi
+
+# Belt-and-suspenders: the udev/uaccess rule above grants ACL access to
+# the active-seat user without requiring `input` group membership, which
+# is great when it works — but on some session configurations (no local
+# seat assigned, headless, certain Wayland compositors) logind never
+# applies the ACL. Add the installing user to `input` as a fallback so
+# utter-watcher works after a re-login even when uaccess silently fails.
+INSTALL_USER="${SUDO_USER:-}"
+if [ -z "$INSTALL_USER" ] && [ -n "${PKEXEC_UID:-}" ]; then
+    INSTALL_USER="$(getent passwd "$PKEXEC_UID" | cut -d: -f1 || true)"
+fi
+if [ -n "$INSTALL_USER" ] && [ "$INSTALL_USER" != "root" ] \
+    && getent group input >/dev/null 2>&1 \
+    && ! id -nG "$INSTALL_USER" 2>/dev/null | tr ' ' '\n' | grep -qx input
+then
+    if usermod -aG input "$INSTALL_USER" 2>/dev/null; then
+        ADDED_INPUT_GROUP=1
+    fi
 fi
 
 # Install & start ydotool (the system service that drives /dev/uinput).
@@ -43,6 +64,23 @@ To start the services in your current session without logging out:
 
 Then hold Right Cmd (or the key you configured) and speak.
 
+To change the PTT key (default: rightmeta), run:
+
+    utter set-key
+
+…then press and hold the key you want and release. The watcher restarts
+automatically.
+
 EOM
 
+if [ "${ADDED_INPUT_GROUP:-0}" = "1" ]; then
+    cat <<EOM
+Added user '$INSTALL_USER' to the 'input' group as a permission fallback.
+Most desktops grant the watcher access immediately via udev/uaccess —
+if utter-watcher fails with 'no input device advertises key …', log out
+and back in to pick up the new group membership.
+
+EOM
+fi
+
 exit 0
diff --git a/packaging/systemd/ydotool.service b/packaging/systemd/ydotool.service
new file mode 100644
index 0000000..c1c42b1
--- /dev/null
+++ b/packaging/systemd/ydotool.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=ydotoold daemon (uinput keystroke injector)
+Documentation=https://github.com/ReimuNotMoe/ydotool
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ydotoold
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target
diff --git a/scripts/install-release.sh b/scripts/install-release.sh
index aedd06a..f21822f 100755
--- a/scripts/install-release.sh
+++ b/scripts/install-release.sh
@@ -13,7 +13,9 @@
 #   2. Fetch the latest utter release from GitHub.
 #   3. Download the right .rpm or .deb for your distro+arch.
 #   4. Install it via dnf / apt (pulls in ydotool, alsa-utils, wl-clipboard,
-#      libnotify as deps; drops udev + systemd files; enables ydotool).
+#      libnotify as deps — plus ydotoold on Debian/Ubuntu, where the daemon
+#      ships in a separate package; drops udev + systemd files; enables
+#      ydotool).
 #   5. Download the Parakeet model (~640 MB) as your user.
 #   6. Start utter-daemon and utter-watcher in your current session.
 
@@ -112,9 +114,9 @@ Verify anytime with:
     systemctl --user status utter-daemon utter-watcher
     journalctl --user -u utter-daemon -f
 
-To change the key (default: rightmeta), edit:
-    systemctl --user edit utter-watcher
+To change the PTT key (default: rightmeta), run:
+    utter set-key
 
-…and override ExecStart with e.g. --key capslock, --key f13, etc.
-See /usr/share/doc/utter/README.md for the full list.
+…then press and hold the key you want and release. The watcher restarts
+automatically. See /usr/share/doc/utter/README.md for details.
 EOM