diff --git a/debian/README.md b/debian/README.md
index 05f9bd8..15152d8 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -40,7 +40,8 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
   (`brew bundle --zap --force-cleanup`; casks and `mas` entries are skipped
   on Linux; mac-only formulae need an `if OS.mac?` guard in the Brewfile)
 - `mise install` for all tools in the mise config
-- caps lock mapped to ctrl; login shell → zsh; default browser → Helium
+- caps lock → ctrl (kernel-level udev hwdb remap, applies in every session)
+- login shell → zsh; default browser → Helium
 - unattended security upgrades (daily, Debian's stock config)
 - pi Umans login: API key pulled from 1Password (`umans-api-key` item,
   `password` field) into `~/.pi/agent/auth.json`
diff --git a/debian/ansible/setup.yml b/debian/ansible/setup.yml
index 432840c..c821b28 100644
--- a/debian/ansible/setup.yml
+++ b/debian/ansible/setup.yml
@@ -257,29 +257,29 @@
       when: kb_sources.stdout | trim in ['@as []', '[]']
       become: false
 
-    - name: Read keyboard xkb options
-      ansible.builtin.command:
-        argv:
-          - gsettings
-          - get
-          - org.gnome.desktop.input-sources
-          - xkb-options
-      register: xkb_options
-      changed_when: false
-      become: false
+    # Caps lock -> ctrl at the kernel level: GNOME on Wayland was not
+    # applying gsettings xkb-options (values correct, gsd-keyboard running,
+    # mutter keymap unchanged), so remap the keycode where every session —
+    # Wayland, X11, GDM, TTY — sees it. Covers built-in, USB, Bluetooth.
+    - name: Map caps lock to ctrl at the kernel level
+      ansible.builtin.copy:
+        dest: /etc/udev/hwdb.d/61-capslock-ctrl.hwdb
+        mode: "0644"
+        content: |
+          evdev:atkbd:dmi:*
+          evdev:input:b0003*
+          evdev:input:b0005*
+           KEY_CAPSLOCK=leftctrl
+      register: capslock_hwdb
+      become: true
 
-    - name: Map caps lock to ctrl
-      ansible.builtin.shell: |
-        schema=org.gnome.desktop.input-sources
-        current=$(gsettings get $schema xkb-options)
-        case "$current" in *ctrl:nocaps*) exit 0 ;; esac
-        if [ "$current" = "@as []" ] || [ "$current" = "[]" ]; then
-          gsettings set $schema xkb-options "['ctrl:nocaps']"
-        else
-          gsettings set $schema xkb-options "${current%]}, 'ctrl:nocaps']"
-        fi
-      when: "'ctrl:nocaps' not in xkb_options.stdout"
-      become: false
+    - name: Apply caps lock remap
+      ansible.builtin.command: "{{ item }}"
+      loop:
+        - systemd-hwdb update
+        - udevadm trigger
+      when: capslock_hwdb is changed
+      become: true
 
     - name: Read current default browser
       ansible.builtin.command: gio mime x-scheme-handler/https