diff --git a/aesel/bin/build-tui.mjs b/aesel/bin/build-tui.mjs
index 254f6b82ef..0a20d00882 100644
--- a/aesel/bin/build-tui.mjs
+++ b/aesel/bin/build-tui.mjs
@@ -8,9 +8,17 @@ import {createHash} from 'node:crypto';
 const root=resolve(dirname(fileURLToPath(import.meta.url)),'..');
 const source=resolve(root,'src');
 const digest=value=>createHash('sha256').update(value).digest('hex');
+// esbuild is pinned by aesel/web's lockfile, which lith installs before packing.
+// system/ only carries it as a Netlify dev dependency, so it is the fallback.
+function loadEsbuild(){
+  for(const manifest of [resolve(root,'web/package.json'),resolve(root,'../system/package.json')]){
+    try{return createRequire(manifest)('esbuild')}
+    catch(error){if(error.code!=='MODULE_NOT_FOUND')throw error}
+  }
+  throw new Error('esbuild not found: run npm ci in aesel/web');
+}
 export async function buildTui(){
-  const require=createRequire(resolve(root,'../system/package.json'));
-  const {build}=require('esbuild');
+  const {build}=loadEsbuild();
   // These objects are also used by the host and integration fixtures. Preserve
   // their module identity; provider implementations remain lazy imports.
   const shared=new Set(['ac-session.mjs','backends.mjs','audience.mjs','diagnostics.mjs','frame-diff.mjs','turn-recovery.mjs','startup-trace.mjs']);
diff --git a/lith/deploy.fish b/lith/deploy.fish
index b97e649f33..2d261f5440 100644
--- a/lith/deploy.fish
+++ b/lith/deploy.fish
@@ -322,8 +322,12 @@ end
 # committed, so it is packed on the box after the pull. Building it here rather than locally means
 # the installer can never point at a version older than the source that shipped
 # with it.
+# The pack bundles the TUI with esbuild from aesel/web's lockfile.
 echo -e "$GREEN-> Packing the Aesel installer tarball...$NC"
-ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR && node aesel/bin/pack.mjs" 2>&1 | tail -2
+ssh -i $SSH_KEY $LITH_USER@$TARGET_HOST "cd $REMOTE_DIR/aesel/web && npm ci --no-audit --no-fund --loglevel=error && cd $REMOTE_DIR && node aesel/bin/pack.mjs" 2>&1 | tail -2
+if test $pipestatus[1] -ne 0
+    echo -e "$RED   Aesel pack failed — the installer tarball is stale. Rerun: ssh lith 'cd $REMOTE_DIR && node aesel/bin/pack.mjs'$NC"
+end
 
 echo -e "$GREEN-> Refreshing notepat.com.amxd build stream...$NC"
 if test $SPACES_READY = true