diff --git a/life-church/playbooks/thinkcenter-helvum.yml b/life-church/playbooks/thinkcenter-helvum.yml
index 02fe99e..14ad325 100644
--- a/life-church/playbooks/thinkcenter-helvum.yml
+++ b/life-church/playbooks/thinkcenter-helvum.yml
@@ -70,6 +70,14 @@
         that: inventory_hostname == 'thinkcenter'
         fail_msg: "Refusing to run — this play is scoped to thinkcenter only."
 
+    - name: "[selfheal] Repair any half-configured dpkg/apt state (prevents cascade failures)"
+      ansible.builtin.shell: |
+        dpkg --configure -a || true
+        apt-get -y -f install || true
+      register: dpkg_selfheal
+      changed_when: "'Setting up' in (dpkg_selfheal.stdout | default(''))"
+      failed_when: false
+
     - name: "[safety] Confirm Ubuntu-family host"
       ansible.builtin.assert:
         that: ansible_facts.os_family == 'Debian'