diff --git a/vpn-node/entrypoint.sh b/vpn-node/entrypoint.sh
index 2a2d30d..b292d0a 100755
--- a/vpn-node/entrypoint.sh
+++ b/vpn-node/entrypoint.sh
@@ -213,15 +213,12 @@ auto_mode() {
 # ════════════════════════════════════════════════════════════════════════════════
 whitelist_eth0
 
-# ── Start pured daemon ────────────────────────────────────────────────────────
-log "Starting pured daemon …"
-NODE_ENV=production /opt/purevpn-cli/pured-linux-x64 --start &
-# Wait until daemon is listening on :9485 (up to 15s)
-for i in $(seq 1 15); do
-    nc -z 127.0.0.1 9485 2>/dev/null && { log "pured listening on :9485"; break; }
-    sleep 1
-done
-nc -z 127.0.0.1 9485 2>/dev/null || log "WARNING: pured not listening after 15s — continuing anyway"
+# pured daemon is NOT pre-started here intentionally.
+# purevpn-cli will call `systemctl is-active pured` → inactive → trigger
+# `sudo purevpn-cli --install-missing-components` which downloads the daemon
+# (via the patched correct URL), writes pured-linux-x64 (no ETXTBSY since
+# the daemon isn't running yet), then starts it via `systemctl start pured`.
+# Pre-starting the daemon caused ETXTBSY when the install tried to overwrite it.
 
 if [[ "$MANUAL_CONNECT" == "true" ]]; then
     manual_mode
diff --git a/vpn-node/systemctl.sh b/vpn-node/systemctl.sh
index 81b1811..4131e54 100644
--- a/vpn-node/systemctl.sh
+++ b/vpn-node/systemctl.sh
@@ -7,9 +7,14 @@ case "$*" in
         echo "inactive"; exit 1 ;;
     *"start pured"*)
         NODE_ENV=production /opt/purevpn-cli/pured-linux-x64 --start &
-        sleep 2; exit 0 ;;
+        for _i in $(seq 1 15); do
+            nc -z 127.0.0.1 9485 2>/dev/null && exit 0
+            sleep 1
+        done
+        exit 0 ;;
     *"stop pured"*|*"disable pured"*)
-        pkill -f "pured-linux-x64" 2>/dev/null || true; exit 0 ;;
+        pkill -9 -f "pured-linux-x64" 2>/dev/null || true
+        sleep 1; exit 0 ;;
     *)
         exit 0 ;;
 esac