diff --git a/INSTALL.md b/INSTALL.md
index db4630b..cdfc743 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -26,7 +26,7 @@ everywhere you see it.
 ## 1. Packages
 
 ```bash
-sudo apt install nginx php8.4-fpm php8.4-redis php8.4-mbstring php8.4-cli redis-server certbot
+sudo apt install nginx php8.4-fpm php8.4-redis php8.4-mbstring php8.4-cli redis-server certbot openssl
 ```
 
 Check the PHP version you actually got (`php -v`) and use that number instead
@@ -75,22 +75,26 @@ redis-cli -s /run/redis-svxportal/redis.sock -a 'PASTE-THE-VALUE-HERE' ping   #
 ## 4. PHP-FPM
 
 Two pools are used. The default pool (`www`) handles all normal pages. A
-second small pool handles only `auth/admin_reflector_api.php`, because that
-script calls `exec()` to reach the sudo helpers (step 9) and you do not want
-`exec()` enabled for the whole site.
+second small pool handles only `auth/admin_reflector_api.php`, so its longer
+timeout and separate process limits do not affect the rest of the site.
 
 ```bash
 sudo cp install/php-fpm-svxadmin.conf /etc/php/8.4/fpm/pool.d/svxadmin.conf
 ```
 
-In the default pool hardening is recommended. Edit
+Hardening of the default pool is recommended. Edit
 `/etc/php/8.4/fpm/pool.d/www.conf` and add at the end:
 
 ```ini
-php_admin_value[disable_functions] = exec,passthru,shell_exec,system,popen,proc_open,proc_close,pcntl_exec,dl,phpinfo,show_source
+php_admin_value[disable_functions] = passthru,shell_exec,system,popen,proc_open,proc_close,pcntl_exec,dl,phpinfo,show_source
 php_admin_value[expose_php] = Off
 ```
 
+Do **not** add `exec` to that list. The portal uses `exec()` in the default
+pool too: `openssl req` to read the e-mail out of a pending CSR, and the sudo
+helpers from the node pages (`auth/node_auth_api.php`, `auth/node_cmd_api.php`,
+`auth/admin_nodes.php`). With `exec` disabled those pages return errors.
+
 Then:
 
 ```bash
@@ -228,8 +232,11 @@ Log in on the web page with that callsign. The **Admin** menu appears.
 The dashboard (node list, map, monitor, last-heard, trunks) fetches JSON and
 Server-Sent Events from `/svxportal/api/...`, which nginx proxies to
 `127.0.0.1:8098`. That backend service is **not included** here. Without it
-the account/admin/talkgroup pages work, but the live node views stay empty
-(the page shows a connection error banner).
+the account/admin/talkgroup pages work, but the front page's node list, map,
+monitor, last-heard and trunks views simply stay **empty**. There is no error
+banner: the API helper returns null on a failed fetch and the page keeps its
+empty tables. Check the browser console (404 on `/svxportal/api/status`) if
+you are unsure.
 
 Endpoints the UI expects: