diff --git a/deploy/files/etc/systemd/system/left4me-web.service.d/10-hardening.conf b/deploy/files/etc/systemd/system/left4me-web.service.d/10-hardening.conf
index 92d00ab..11fec7a 100644
--- a/deploy/files/etc/systemd/system/left4me-web.service.d/10-hardening.conf
+++ b/deploy/files/etc/systemd/system/left4me-web.service.d/10-hardening.conf
@@ -28,7 +28,12 @@ ProtectClock=true
 ProtectControlGroups=true
 ProtectHostname=true
 LockPersonality=true
-SystemCallArchitectures=native
+# `native x86` (not just `native`) — the install job fork-execs
+# steamcmd_linux, a 32-bit binary, which makes i386-numbered syscalls.
+# Under `native` alone the kernel SIGSYS-kills it (bash exit 159 =
+# 128+SIGSYS). Mirrors the server unit, which needs the same allowance
+# for srcds_linux. See deploy/files/etc/systemd/system/left4me-server@.service.d/10-hardening.conf.
+SystemCallArchitectures=native x86
 SystemCallFilter=@system-service
 SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
diff --git a/deploy/tests/test_example_units.py b/deploy/tests/test_example_units.py
index 7850856..dac8b31 100644
--- a/deploy/tests/test_example_units.py
+++ b/deploy/tests/test_example_units.py
@@ -261,7 +261,9 @@ def test_web_hardening_dropin_present_with_directives():
     ):
         assert d in text, f"missing {d!r} in web hardening drop-in"
     # WEB-specific
-    assert "SystemCallArchitectures=native" in text
+    # `native x86` (not `native`) because the install job fork-execs
+    # steamcmd_linux (32-bit). Plain `native` produces SIGSYS (bash exit 159).
+    assert "SystemCallArchitectures=native x86" in text
     assert "SystemCallFilter=@system-service" in text
     assert "SystemCallFilter=~@debug @mount @raw-io @reboot @swap @cpu-emulation @obsolete" in text
     # WEB must NOT include the sudo-incompatible directives.