diff --git a/deploy/systemd/astrape-oracle.service b/deploy/systemd/astrape-oracle.service
index 7faf4d0..7692a2e 100644
--- a/deploy/systemd/astrape-oracle.service
+++ b/deploy/systemd/astrape-oracle.service
@@ -10,6 +10,12 @@ Group=gibil
 WorkingDirectory=/srv/astrape
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
+# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
+# this, Python prepends the working directory to sys.path and the repo root
+# /srv/astrape/gibil shadows the installed package as a namespace portion --
+# gibil.__file__ becomes None and imports work only by accident. All code is
+# installed into the venv, so nothing needs the working directory on sys.path.
+Environment=PYTHONSAFEPATH=1
 Environment=ASTRAPE_ORACLE_POLL_SECONDS=300
 ExecStart=/srv/astrape/.venv/bin/python -m astrape_oracle.scripts.daemons.oracle_daemon
 Restart=always
diff --git a/deploy/systemd/astrape-usage-tcn-training.service b/deploy/systemd/astrape-usage-tcn-training.service
index 199a50a..f6acd4a 100644
--- a/deploy/systemd/astrape-usage-tcn-training.service
+++ b/deploy/systemd/astrape-usage-tcn-training.service
@@ -10,6 +10,12 @@ Group=gibil
 WorkingDirectory=/srv/astrape
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
+# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
+# this, Python prepends the working directory to sys.path and the repo root
+# /srv/astrape/gibil shadows the installed package as a namespace portion --
+# gibil.__file__ becomes None and imports work only by accident. All code is
+# installed into the venv, so nothing needs the working directory on sys.path.
+Environment=PYTHONSAFEPATH=1
 # This host is a Xeon E5-2650 v2: no AVX2, no FMA. Torch dispatches kernels it
 # cannot execute and dies with SIGILL inside Adam, so force the scalar path.
 # The real fix is external_tcn on a GPU host; this keeps the local run alive
diff --git a/deploy/systemd/astrape-weather-forecast.service b/deploy/systemd/astrape-weather-forecast.service
index 7ca5576..606010b 100644
--- a/deploy/systemd/astrape-weather-forecast.service
+++ b/deploy/systemd/astrape-weather-forecast.service
@@ -10,6 +10,12 @@ Group=gibil
 WorkingDirectory=/srv/astrape
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
+# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
+# this, Python prepends the working directory to sys.path and the repo root
+# /srv/astrape/gibil shadows the installed package as a namespace portion --
+# gibil.__file__ becomes None and imports work only by accident. All code is
+# installed into the venv, so nothing needs the working directory on sys.path.
+Environment=PYTHONSAFEPATH=1
 
 ExecStart=/srv/astrape/.venv/bin/python -m astrape_oracle.scripts.daemons.weather_forecast_daemon
 Restart=always
diff --git a/deploy/systemd/astrape-weather-station.service b/deploy/systemd/astrape-weather-station.service
index ac42e55..43bb67d 100644
--- a/deploy/systemd/astrape-weather-station.service
+++ b/deploy/systemd/astrape-weather-station.service
@@ -10,6 +10,12 @@ Group=gibil
 WorkingDirectory=/srv/astrape
 Environment=PYTHONUNBUFFERED=1
 Environment=PYTHONDONTWRITEBYTECODE=1
+# WorkingDirectory is /srv/astrape, which also holds the gibil checkout. Without
+# this, Python prepends the working directory to sys.path and the repo root
+# /srv/astrape/gibil shadows the installed package as a namespace portion --
+# gibil.__file__ becomes None and imports work only by accident. All code is
+# installed into the venv, so nothing needs the working directory on sys.path.
+Environment=PYTHONSAFEPATH=1
 Environment=ECOWITT_GW3000_HOST=10.24.88.176
 Environment=ECOWITT_GW3000_POLL_SECONDS=60
 ExecStart=/srv/astrape/.venv/bin/python -m astrape_oracle.scripts.daemons.weather_station_daemon