diff --git a/update_and_deploy_fips.sh b/update_and_deploy_fips.sh
index a46b43c..7ad1b7d 100755
--- a/update_and_deploy_fips.sh
+++ b/update_and_deploy_fips.sh
@@ -240,11 +240,23 @@ restart_unit_with_diagnostics() {
 }
 
 ensure_dnsmasq_package() {
+  local has_dnsmasq_cmd="no"
+  local has_dnsmasq_unit="no"
+
   if command -v dnsmasq >/dev/null 2>&1; then
+    has_dnsmasq_cmd="yes"
+  fi
+  if sudo systemctl list-unit-files dnsmasq.service --no-legend 2>/dev/null | grep -q '^dnsmasq\.service'; then
+    has_dnsmasq_unit="yes"
+  fi
+
+  # Some systems ship dnsmasq binary without the dnsmasq.service unit.
+  # In that case we still need to install the full service package.
+  if [[ "${has_dnsmasq_cmd}" == "yes" && "${has_dnsmasq_unit}" == "yes" ]]; then
     return
   fi
 
-  echo "==> dnsmasq not found; installing"
+  echo "==> Installing/repairing dnsmasq package for service support"
   if command -v apt-get >/dev/null 2>&1; then
     install_system_packages dnsmasq
   elif command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then
@@ -264,6 +276,11 @@ ensure_dnsmasq_package() {
     echo "Warning: dnsmasq command is still unavailable after package install." >&2
     return 1
   fi
+
+  if ! sudo systemctl list-unit-files dnsmasq.service --no-legend 2>/dev/null | grep -q '^dnsmasq\.service'; then
+    echo "Warning: dnsmasq.service unit still missing after package install." >&2
+    return 1
+  fi
 }
 
 configure_dnsmasq_fips_dns() {