diff --git a/ADR.md b/ADR.md
index 8405655..86a8c4b 100644
--- a/ADR.md
+++ b/ADR.md
@@ -394,8 +394,8 @@ failure, then listens. `vpnrouter_auth` turns every failure of the database into
 psycopg (Ubuntu ships only its pure-Python implementation) finds libpq through the dynamic linker
 cache, which dpkg refreshes with its deferred `ldconfig` only at the end of an installation, so a
 service started during the installation cannot import it yet; a failed import cannot be repeated
-in the same process either, as psycopg caches the lookup. The services therefore import psycopg
-plainly, and their units wait instead: `ExecStartPre=wait-for-libpq`, a shell script of each
+in the same process either, as psycopg caches the lookup. The services and `vpn-router-setup`
+therefore import psycopg plainly, and their units wait instead: `ExecStartPre=wait-for-libpq`, a shell script of each
 package, waits until `ldconfig -p` lists `libpq.so.5`, within `TimeoutStartSec=5min`. The
 maintainer scripts start the units with `systemctl --no-block` (debhelper's start is turned off),
 because a start that waited would hold dpkg before its `ldconfig`.
diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog
index 5c5c42f..2f2344a 100644
--- a/debian-package/debian/changelog
+++ b/debian-package/debian/changelog
@@ -1,3 +1,13 @@
+vpn-router (0.33.3-1) unstable; urgency=medium
+
+  fix: vpn-router-setup runs on a new installation once libpq can be found.
+
+  * The vpn-router-setup unit waits, with wait-for-libpq, until libpq is in
+    the linker cache before it runs setup.
+  * The package starts vpn-router-setup without waiting for it.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 21:00:00 +0100
+
 vpn-router (0.33.2-1) unstable; urgency=medium
 
   fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
diff --git a/debian-package/debian/postinst b/debian-package/debian/postinst
index 3ea50ca..8eb8961 100755
--- a/debian-package/debian/postinst
+++ b/debian-package/debian/postinst
@@ -71,9 +71,11 @@ case "$1" in
         # setting the forward policy all belong to vpn-router-setup, which does
         # them only once the configuration says this host is a router.
 
-        # The web service waits for libpq in the linker cache, which dpkg
-        # refreshes after this script, so it is started without waiting for it.
+        # The setup and web services wait for libpq in the linker cache, which
+        # dpkg refreshes after this script, so they are started without waiting
+        # for them.
         if [ -d /run/systemd/system ]; then
+            systemctl --no-block restart vpn-router-setup.service >/dev/null 2>&1 || true
             systemctl --no-block restart vpn-router-web.service >/dev/null 2>&1 || true
         fi
         ;;
diff --git a/debian-package/debian/rules b/debian-package/debian/rules
index a60aaef..46fa571 100755
--- a/debian-package/debian/rules
+++ b/debian-package/debian/rules
@@ -3,7 +3,7 @@
 	dh $@
 
 override_dh_installsystemd:
-	dh_installsystemd --name=vpn-router-setup
+	dh_installsystemd --name=vpn-router-setup --no-start
 	dh_installsystemd --name=vpn-router-docker
 	dh_installsystemd --name=vpn-router-web --no-start
 	dh_installsystemd --name=vpn-router-metrics --no-enable --no-start
diff --git a/debian-package/debian/vpn-router.vpn-router-setup.service b/debian-package/debian/vpn-router.vpn-router-setup.service
index 1f88452..3e76c3e 100644
--- a/debian-package/debian/vpn-router.vpn-router-setup.service
+++ b/debian-package/debian/vpn-router.vpn-router-setup.service
@@ -6,6 +6,7 @@ After=network-online.target docker.service postgresql.service
 
 [Service]
 Type=oneshot
+ExecStartPre=/usr/lib/vpn-router/wait-for-libpq
 ExecStart=/usr/lib/vpn-router/setup
 RemainAfterExit=yes
 
diff --git a/debian-package/src/usr/lib/vpn-router/wait-for-libpq b/debian-package/src/usr/lib/vpn-router/wait-for-libpq
index 3f9e0fd..0740475 100755
--- a/debian-package/src/usr/lib/vpn-router/wait-for-libpq
+++ b/debian-package/src/usr/lib/vpn-router/wait-for-libpq
@@ -1,6 +1,7 @@
 #!/bin/sh
 # Wait until libpq is in the dynamic linker cache, where psycopg looks it up.
-# ExecStartPre= of vpn-router-web.service; TimeoutStartSec= of the unit bounds the wait.
+# ExecStartPre= of vpn-router-setup.service, vpn-router-web.service and vpn-router-metrics.service;
+# TimeoutStartSec= of the unit bounds the wait.
 
 reported=
 until ldconfig -p | grep -q '^[[:space:]]*libpq\.so\.5 '; do