diff --git a/packages/secubox-eye-square/debian/changelog b/packages/secubox-eye-square/debian/changelog
index 28d1c24f..85a6b11e 100644
--- a/packages/secubox-eye-square/debian/changelog
+++ b/packages/secubox-eye-square/debian/changelog
@@ -1,3 +1,15 @@
+secubox-eye-square (1.0.3-1~bookworm1) bookworm; urgency=medium
+
+  * Relocate firstboot.sh from /usr/local/sbin/ to /usr/lib/secubox/
+    (Debian policy reserves /usr/local/ for the local admin; dh_usrlocal
+    was rejecting the staged tree). Update ExecStart in
+    secubox-firstboot.service to match the new path. The new location
+    is namespaced under /usr/lib/secubox/ consistent with sister
+    helpers (find-usb-serial, leasewatch.sh).
+  * Closes #207.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Tue, 19 May 2026 06:55:00 +0200
+
 secubox-eye-square (1.0.2-1~bookworm1) bookworm; urgency=medium
 
   * Fix debian/rules content drift: drop the install block for
diff --git a/remote-ui/square/files/etc/systemd/system/secubox-firstboot.service b/remote-ui/square/files/etc/systemd/system/secubox-firstboot.service
index c96dd2d7..76c1c2e1 100644
--- a/remote-ui/square/files/etc/systemd/system/secubox-firstboot.service
+++ b/remote-ui/square/files/etc/systemd/system/secubox-firstboot.service
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: LicenseRef-CMSD-1.0
 # Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
 #
-# Runs /usr/local/sbin/firstboot.sh once on first boot. The script is idempotent
+# Runs /usr/lib/secubox/firstboot.sh once on first boot. The script is idempotent
 # (guards on /etc/.secubox-eye-square-firstboot-done), so a second invocation is a no-op.
 
 [Unit]
@@ -13,7 +13,7 @@ ConditionPathExists=!/etc/.secubox-eye-square-firstboot-done
 [Service]
 Type=oneshot
 RemainAfterExit=no
-ExecStart=/usr/local/sbin/firstboot.sh
+ExecStart=/usr/lib/secubox/firstboot.sh
 
 [Install]
 WantedBy=multi-user.target
diff --git a/remote-ui/square/files/usr/local/sbin/firstboot.sh b/remote-ui/square/files/usr/lib/secubox/firstboot.sh
similarity index 100%
rename from remote-ui/square/files/usr/local/sbin/firstboot.sh
rename to remote-ui/square/files/usr/lib/secubox/firstboot.sh