diff --git a/deploy.sh b/deploy.sh
index 254f61d..e2e32d3 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -46,6 +46,31 @@ fi
 
 [ "$(id -u)" = 0 ] || { echo "Run with sudo (writes to /etc, /usr)."; exit 1; }
 
+# Check for essential package dependencies
+echo "== dependency check =="
+REQUIRED_PACKAGES=(
+    hostapd
+    iw
+    nftables
+    dnsmasq
+    systemd-resolved
+)
+OPTIONAL_PACKAGES=(
+    rsync
+    mosquitto
+    gpsd
+    gpsd-clients
+    python3-paho-mqtt
+    python3-gps
+    python3-bleak
+    mobile-broadband-provider-info
+    zerotier-one
+)
+for pkg in "${REQUIRED_PACKAGES[@]}"; do
+    dpkg -s "$pkg" >/dev/null 2>&1 || { echo "MISSING REQUIRED: $pkg (apt install $pkg)"; exit 1; }
+done
+# Note: warn() is defined below; we'll check optional packages after it's defined
+
 # Collected below and persisted to WARNINGS_FILE so the Cockpit vanrouter page
 # can surface deploy-time issues (missing deps, unedited example configs, drift)
 # without someone having to remember to scroll back through deploy output.
@@ -55,6 +80,13 @@ warn() {  # warn <message...> — prints "   -> <message>" (as before) and recor
     echo "   -> $*"
     WARNINGS+=("$*")
 }
+
+# Check optional packages now that warn() is defined
+for pkg in "${OPTIONAL_PACKAGES[@]}"; do
+    if ! dpkg -s "$pkg" >/dev/null 2>&1; then
+        warn "optional package not installed: $pkg (apt install $pkg)"
+    fi
+done
 write_warnings() {
     install -d -m0755 "$(dirname "$WARNINGS_FILE")"
     {