diff --git a/deploy.sh b/deploy.sh
index faa82f1..a9eb104 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -2,12 +2,29 @@
 # Deploy vanlink configs/scripts (Pi 4 "wan" port) to their system locations.
 # Usage:  cd ~/vanlink && sudo ./deploy.sh
 # Idempotent. Netplan (wlan0 + Starlink NIC = NM-managed WANs; eth0 is a LAN
-# port on br0) is NOT touched here — reference copy in ap/50-van-wan.yaml,
-# applied once manually (apply flaps uplinks).
+# port on br0) is NOT deployed here — reference copy in ap/50-van-wan.yaml,
+# applied once manually (apply flaps uplinks). We do check it for drift below.
 set -euo pipefail
 cd "$(dirname "$(readlink -f "$0")")"
 [ "$(id -u)" = 0 ] || { echo "Run with sudo (writes to /etc, /usr)."; exit 1; }
 
+echo "== netplan drift check =="
+# Netplan is never installed by this script (applying it flaps the uplinks —
+# see note below), so it's easy to edit ap/50-van-wan.yaml and forget the
+# manual `netplan apply` step. Warn loudly rather than silently drifting.
+if [ ! -f /etc/netplan/50-van-wan.yaml ]; then
+    echo "   -> WARNING: /etc/netplan/50-van-wan.yaml is missing. Repo config"
+    echo "      was never deployed to this system. Run manually:"
+    echo "        sudo cp ap/50-van-wan.yaml /etc/netplan/50-van-wan.yaml"
+    echo "        sudo netplan generate && sudo netplan apply"
+elif ! diff -q ap/50-van-wan.yaml /etc/netplan/50-van-wan.yaml >/dev/null 2>&1; then
+    echo "   -> WARNING: /etc/netplan/50-van-wan.yaml differs from ap/50-van-wan.yaml."
+    diff -u /etc/netplan/50-van-wan.yaml ap/50-van-wan.yaml || true
+    echo "      Deploy the change manually:"
+    echo "        sudo cp ap/50-van-wan.yaml /etc/netplan/50-van-wan.yaml"
+    echo "        sudo netplan generate && sudo netplan apply"
+fi
+
 echo "== access point =="
 install -D -m0644 ap/hostapd.conf           /etc/hostapd/hostapd.conf
 install -D -m0644 ap/hostapd-restart.conf   /etc/systemd/system/hostapd.service.d/restart.conf