diff --git a/deploy/deploy-test-server.sh b/deploy/deploy-test-server.sh
index 4cd11f6..2989a28 100755
--- a/deploy/deploy-test-server.sh
+++ b/deploy/deploy-test-server.sh
@@ -85,9 +85,9 @@ fi
 
 if command -v apt-get >/dev/null 2>&1; then
     $sudo_cmd apt-get update
-    $sudo_cmd apt-get install -y python3 python3-venv python3-pip curl ca-certificates tar gzip util-linux sudo
+    $sudo_cmd apt-get install -y python3 python3-venv python3-pip curl ca-certificates tar gzip util-linux sudo coreutils p7zip-full
 elif command -v dnf >/dev/null 2>&1; then
-    $sudo_cmd dnf install -y python3 python3-pip curl ca-certificates tar gzip util-linux sudo
+    $sudo_cmd dnf install -y python3 python3-pip curl ca-certificates tar gzip util-linux sudo coreutils p7zip p7zip-plugins
 else
     printf 'Unsupported package manager: expected apt-get or dnf\n' >&2
     exit 1
diff --git a/deploy/tests/test_deploy_artifacts.py b/deploy/tests/test_deploy_artifacts.py
index b4e068b..f3f739c 100644
--- a/deploy/tests/test_deploy_artifacts.py
+++ b/deploy/tests/test_deploy_artifacts.py
@@ -306,6 +306,24 @@ def test_deploy_script_does_not_install_bubblewrap():
         assert "bwrap" not in line, line
 
 
+def test_deploy_script_installs_script_overlay_tooling():
+    # Script overlays commonly need 7z and md5sum (e.g. l4d2center map sync).
+    # coreutils ships md5sum and is technically essential, but listing it
+    # explicitly makes the contract obvious and survives slim base images.
+    script = DEPLOY_SCRIPT.read_text().splitlines()
+    apt_lines = [l for l in script if "apt-get install" in l]
+    dnf_lines = [l for l in script if "dnf install" in l]
+    assert apt_lines, "expected an apt-get install line"
+    assert dnf_lines, "expected a dnf install line"
+    for line in apt_lines:
+        assert "p7zip-full" in line, line
+        assert "coreutils" in line, line
+    for line in dnf_lines:
+        # Fedora/RHEL split: p7zip provides 7za, p7zip-plugins provides 7z.
+        assert "p7zip" in line and "p7zip-plugins" in line, line
+        assert "coreutils" in line, line
+
+
 def test_deploy_script_tightens_left4me_db_permissions():
     script = DEPLOY_SCRIPT.read_text()
     # The DB and its WAL/SHM sidecars must be left4me:left4me 0640 — owner