diff --git a/bin/baudbot b/bin/baudbot
index 2db0e1c..720e71c 100755
--- a/bin/baudbot
+++ b/bin/baudbot
@@ -123,7 +123,7 @@ case "${1:-}" in
 
   status)
     shift
-    if has_systemd && systemctl is-enabled baudbot &>/dev/null 2>&1; then
+    if has_systemd && systemctl is-enabled baudbot &>/dev/null; then
       exec systemctl status baudbot "$@"
     else
       # Fallback: check if baudbot_agent has pi running
@@ -138,7 +138,7 @@ case "${1:-}" in
 
   logs)
     shift
-    if has_systemd && systemctl is-enabled baudbot &>/dev/null 2>&1; then
+    if has_systemd && systemctl is-enabled baudbot &>/dev/null; then
       exec journalctl -u baudbot -f "$@"
     else
       echo "No systemd unit. Check tmux sessions:"
@@ -254,14 +254,28 @@ case "${1:-}" in
 
   update)
     shift
-    # For now: git pull + deploy
     require_root "update"
     echo "=== Pulling latest ==="
     cd "$BAUDBOT_ROOT"
     git pull origin main
     echo ""
     echo "=== Deploying ==="
-    exec "$BAUDBOT_ROOT/bin/deploy.sh" "$@"
+    "$BAUDBOT_ROOT/bin/deploy.sh" "$@"
+    echo ""
+    # Restart if currently running
+    if has_systemd && systemctl is-active baudbot &>/dev/null; then
+      echo "=== Restarting ==="
+      systemctl restart baudbot
+      # Wait for ExecStartPre hooks + process init
+      sleep 3
+      if systemctl is-active baudbot &>/dev/null; then
+        echo "✅ Updated and running"
+      else
+        echo "⚠️  Deployed but agent didn't restart — check: baudbot logs"
+      fi
+    else
+      echo "✅ Updated. Start with: sudo baudbot start"
+    fi
     ;;
 
   uninstall)
diff --git a/bin/deploy.sh b/bin/deploy.sh
index 8db219e..ddc7c5b 100755
--- a/bin/deploy.sh
+++ b/bin/deploy.sh
@@ -270,8 +270,18 @@ fi
 echo "Deploying config..."
 
 # Determine who invoked this (the admin user)
-# BAUDBOT_CONFIG_USER env var overrides detection (used by install.sh)
-DEPLOY_USER="${BAUDBOT_CONFIG_USER:-${SUDO_USER:-$(whoami)}}"
+# Priority: BAUDBOT_CONFIG_USER env > SUDO_USER > repo owner > whoami
+if [ -n "${BAUDBOT_CONFIG_USER:-}" ]; then
+  DEPLOY_USER="$BAUDBOT_CONFIG_USER"
+elif [ -n "${SUDO_USER:-}" ] && [ "${SUDO_USER:-}" != "root" ]; then
+  DEPLOY_USER="$SUDO_USER"
+else
+  # Detect from repo ownership (the admin owns the source)
+  DEPLOY_USER=$(stat -c '%U' "$BAUDBOT_SRC" 2>/dev/null || echo "")
+  if [ -z "$DEPLOY_USER" ] || [ "$DEPLOY_USER" = "root" ]; then
+    DEPLOY_USER="$(whoami)"
+  fi
+fi
 DEPLOY_HOME=$(getent passwd "$DEPLOY_USER" | cut -d: -f6 2>/dev/null || echo "")
 ADMIN_CONFIG="$DEPLOY_HOME/.baudbot/.env"