diff --git a/frontend-modern/public/install-host-agent.sh b/frontend-modern/public/install-host-agent.sh
index c24ea4f..233c4ba 100755
--- a/frontend-modern/public/install-host-agent.sh
+++ b/frontend-modern/public/install-host-agent.sh
@@ -246,12 +246,12 @@ fi
 
 # Download agent binary from Pulse server
 DOWNLOAD_URL="$PULSE_URL/download/pulse-host-agent?platform=$PLATFORM&arch=$ARCH"
+CHECKSUM_URL="$PULSE_URL/download/pulse-host-agent.sha256?platform=$PLATFORM&arch=$ARCH"
 TEMP_BINARY="/tmp/pulse-host-agent-$$.tmp"
 
 log_info "Downloading agent binary from $PULSE_URL..."
 
 DOWNLOAD_SUCCESS=false
-CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
 
 if command -v curl &> /dev/null; then
     if curl -fL --progress-bar -o "$TEMP_BINARY" "$DOWNLOAD_URL" 2>&1; then
diff --git a/frontend-modern/src/components/Settings/APITokenManager.tsx b/frontend-modern/src/components/Settings/APITokenManager.tsx
index cf1f213..eb134fb 100644
--- a/frontend-modern/src/components/Settings/APITokenManager.tsx
+++ b/frontend-modern/src/components/Settings/APITokenManager.tsx
@@ -183,8 +183,8 @@ export const APITokenManager: Component<APITokenManagerProps> = (props) => {
       const { token, record } = await SecurityAPI.createToken(trimmedName, scopePayload);
 
       setTokens((prev) => [record, ...prev]);
-      setNewTokenValue(token);
       setNewTokenRecord(record);
+      setNewTokenValue(token);
       setNameInput('');
 
       showTokenReveal({
@@ -212,7 +212,8 @@ export const APITokenManager: Component<APITokenManagerProps> = (props) => {
     }
   };
 
-  const tokenHint = (record: APITokenRecord) => {
+  const tokenHint = (record: APITokenRecord | null | undefined) => {
+    if (!record) return '—';
     if (record.prefix && record.suffix) {
       return `${record.prefix}…${record.suffix}`;
     }
@@ -398,7 +399,7 @@ export const APITokenManager: Component<APITokenManagerProps> = (props) => {
           class="flex flex-wrap items-center justify-between gap-3 border border-green-300/70 text-sm text-green-800 dark:border-green-700/70 dark:text-green-200"
         >
           <span>
-            ✓ Token generated: <strong>{newTokenRecord()?.name || 'Untitled'}</strong> ({tokenHint(newTokenRecord()!)})
+            ✓ Token generated: <strong>{newTokenRecord()?.name || 'Untitled'}</strong> ({tokenHint(newTokenRecord())})
           </span>
           <div class="flex items-center gap-3 text-xs">
             <button onClick={reopenTokenDialog} class="font-medium underline decoration-green-500/50 underline-offset-2 hover:text-green-900 dark:hover:text-green-100">
diff --git a/scripts/install-host-agent.sh b/scripts/install-host-agent.sh
index c24ea4f..233c4ba 100755
--- a/scripts/install-host-agent.sh
+++ b/scripts/install-host-agent.sh
@@ -246,12 +246,12 @@ fi
 
 # Download agent binary from Pulse server
 DOWNLOAD_URL="$PULSE_URL/download/pulse-host-agent?platform=$PLATFORM&arch=$ARCH"
+CHECKSUM_URL="$PULSE_URL/download/pulse-host-agent.sha256?platform=$PLATFORM&arch=$ARCH"
 TEMP_BINARY="/tmp/pulse-host-agent-$$.tmp"
 
 log_info "Downloading agent binary from $PULSE_URL..."
 
 DOWNLOAD_SUCCESS=false
-CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
 
 if command -v curl &> /dev/null; then
     if curl -fL --progress-bar -o "$TEMP_BINARY" "$DOWNLOAD_URL" 2>&1; then