diff --git a/deploy/systemd/astrape-web.service b/deploy/systemd/astrape-web.service
index 6babf92..2adecc3 100644
--- a/deploy/systemd/astrape-web.service
+++ b/deploy/systemd/astrape-web.service
@@ -10,6 +10,12 @@ Group=gibil
 WorkingDirectory=/srv/astrape
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
+# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
+# this, Python prepends the working directory to sys.path and the repo root
+# /srv/astrape/gibil shadows the installed package as a namespace portion --
+# gibil.__file__ becomes None and imports work only by accident. All code is
+# installed into the venv, so nothing needs the working directory on sys.path.
+Environment=PYTHONSAFEPATH=1
 
 ExecStart=/srv/astrape/.venv/bin/python -m astrape_dashboard.scripts.daemons.web_daemon
 Restart=always