diff --git a/packages/secubox-appstore/debian/changelog b/packages/secubox-appstore/debian/changelog
index dcac2771..00e16586 100644
--- a/packages/secubox-appstore/debian/changelog
+++ b/packages/secubox-appstore/debian/changelog
@@ -1,4 +1,4 @@
-secubox-appstore (0.3.2-1~bookworm1) bookworm; urgency=medium
+secubox-appstore (0.3.3-1~bookworm1) bookworm; urgency=medium
 
   * fix(#768): sbx-apt-mesh resolves apt.secubox.in to the rendezvous wg-mesh IP
     via /etc/hosts, so the existing signed https source installs over WireGuard
diff --git a/packages/secubox-appstore/sbin/sbx-apt-mesh b/packages/secubox-appstore/sbin/sbx-apt-mesh
index 153af240..8783969d 100755
--- a/packages/secubox-appstore/sbin/sbx-apt-mesh
+++ b/packages/secubox-appstore/sbin/sbx-apt-mesh
@@ -20,8 +20,12 @@ cmd="${1:-status}"; ip="${2:-$(_rv_ip)}"
 case "$cmd" in
   enable)
     [ "$(_self_ip)" = "$ip" ] && { echo "this node is the rendezvous ($ip) — repo is local"; exit 0; }
-    sed -i "/$TAG\$/d" "$HOSTS"                       # drop our previous line
-    echo "$ip $DOMAIN $TAG" >> "$HOSTS"               # resolve over the mesh
+    # Prepend our line so it WINS over any pre-existing apt.secubox.in entry
+    # (getent returns the first match); the original stays and resumes on
+    # disable. Resolves the signed https repo over the mesh.
+    tmp=$(mktemp)
+    { echo "$ip $DOMAIN $TAG"; grep -v "$TAG\$" "$HOSTS"; } > "$tmp"
+    cat "$tmp" > "$HOSTS"; rm -f "$tmp"
     echo "$DOMAIN -> $(getent hosts $DOMAIN | awk '{print $1}' | head -1) (mesh)"
     apt-get update >/dev/null 2>&1 && echo "apt-get update OK — packages now install over the mesh, GPG-verified" \
       || { echo "apt-get update FAILED — check mesh reach to $ip:443"; exit 3; }