diff --git a/docs/PULSE_SENSOR_PROXY_HARDENING.md b/docs/PULSE_SENSOR_PROXY_HARDENING.md
index ceec35f..1425765 100644
--- a/docs/PULSE_SENSOR_PROXY_HARDENING.md
+++ b/docs/PULSE_SENSOR_PROXY_HARDENING.md
@@ -184,6 +184,8 @@ If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/
 
 This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again.
 
+> **Advanced option**: If you’d rather refresh in place without removing the node, you can rerun the host-side installer directly (e.g. `sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id>`). The script is idempotent, but re-adding through the UI guarantees the full host + Pulse configuration is rebuilt.
+
 ### Runtime Verification
 
 **Check container is unprivileged:**
diff --git a/frontend-modern/src/components/LegacySSHBanner.tsx b/frontend-modern/src/components/LegacySSHBanner.tsx
index 2e5c502..f013d21 100644
--- a/frontend-modern/src/components/LegacySSHBanner.tsx
+++ b/frontend-modern/src/components/LegacySSHBanner.tsx
@@ -79,7 +79,7 @@ export function LegacySSHBanner() {
               <div class="flex items-center gap-3 flex-wrap">
                 <div class="text-sm space-x-1">
                   <span class="font-medium">Legacy temperature monitoring detected.</span>
-                  <span>Remove each node and re-add it using the installer script in Settings → Nodes.</span>
+                  <span>Remove each node and re-add it using the installer script in Settings → Nodes (advanced: rerun the host installer script directly).</span>
                   <a
                     href="https://github.com/rcourtman/Pulse/blob/main/docs/PULSE_SENSOR_PROXY_HARDENING.md#upgrading-existing-installations"
                     target="_blank"
diff --git a/internal/api/diagnostics.go b/internal/api/diagnostics.go
index aea4e00..17700ca 100644
--- a/internal/api/diagnostics.go
+++ b/internal/api/diagnostics.go
@@ -202,13 +202,13 @@ func (r *Router) handleDiagnostics(w http.ResponseWriter, req *http.Request) {
 	}
 
 	if !proxyDiag.SocketFound {
-		proxyDiag.Notes = append(proxyDiag.Notes, "No proxy socket detected inside the container. Remove the affected node in Pulse, then re-add it using the installer script from Settings → Nodes to regenerate the mount.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "No proxy socket detected inside the container. Remove the affected node in Pulse, then re-add it using the installer script from Settings → Nodes to regenerate the mount (or rerun the host installer script if you prefer).")
 	} else if proxyDiag.SocketPath == "/run/pulse-sensor-proxy/pulse-sensor-proxy.sock" {
-		proxyDiag.Notes = append(proxyDiag.Notes, "Proxy socket is exposed via /run. Remove and re-add this node with the Settings → Nodes installer script so the managed /mnt/pulse-proxy mount is applied.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "Proxy socket is exposed via /run. Remove and re-add this node with the Settings → Nodes installer script so the managed /mnt/pulse-proxy mount is applied (advanced: rerun the host installer script).")
 	}
 
 	if proxyDiag.LegacySSHDetected && proxyDiag.RecommendProxyUpgrade {
-		proxyDiag.Notes = append(proxyDiag.Notes, "Legacy SSH configuration detected. Remove each node from Pulse and re-add it using the installer script copied from Settings → Nodes to migrate to the secure proxy.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "Legacy SSH configuration detected. Remove each node from Pulse and re-add it using the installer script copied from Settings → Nodes (or rerun the host installer script) to migrate to the secure proxy.")
 	}
 
 	diag.TemperatureProxy = proxyDiag