The jellyfin-webhook-install oneshot has 'wantedBy = jellyfin.service', which only runs it when jellyfin (re)starts. On first rollout to a host where jellyfin is already running, the unit gets added but never fires, leaving the Webhook plugin files absent -- jellyfin-webhook-configure then gets 404 from /Plugins/$GUID/Configuration and deploy-rs rolls back. Pinning jellyfin.restartTriggers to the plugin package + install script forces a restart whenever either derivation changes, which pulls install in via the existing before/wantedBy chain.