diff --git a/deploy/openwrt/netgrip/files/usr/libexec/netgrip-heal-register b/deploy/openwrt/netgrip/files/usr/libexec/netgrip-heal-register
index fb23a390..fea68fdd 100755
--- a/deploy/openwrt/netgrip/files/usr/libexec/netgrip-heal-register
+++ b/deploy/openwrt/netgrip/files/usr/libexec/netgrip-heal-register
@@ -55,8 +55,12 @@ if command -v apk >/dev/null 2>&1; then
 	esac
 	pkgfile=/tmp/netgrip-heal.apk
 else
-	arch=$(opkg print-architecture 2>/dev/null | awk 'tolower($1)=="arch"{print $2; exit}')
-	[ -n "$arch" ] || arch=$(opkg status 2>/dev/null | sed -n 's/^Architecture: *//p' | head -n1)
+	# print-architecture lists pseudo-archs (all, noarch) first; the arch of
+	# any installed native package is the reliable source.
+	arch=$(opkg status busybox 2>/dev/null | sed -n 's/^Architecture: *//p' | head -n1)
+	if [ -z "$arch" ] || [ "$arch" = "all" ] || [ "$arch" = "noarch" ]; then
+		arch=$(opkg print-architecture 2>/dev/null | awk 'tolower($1)=="arch" && $2!="all" && $2!="noarch" {print $2; exit}')
+	fi
 	[ -n "$arch" ] || { log "cannot determine architecture"; exit 1; }
 	asset="netgrip*_${arch}.ipk"
 	pkgfile=/tmp/netgrip-heal.ipk
@@ -75,7 +79,7 @@ done
 json=$(wget -q -O - -T 15 "$RELEASES_API" 2>/dev/null)
 [ -n "$json" ] || { log "cannot reach GitHub releases API"; exit 1; }
 
-url=$(printf '%s' "$json" | tr ',' '\n' | grep -o '"browser_download_url": *"[^"]*"' | cut -d'"' -f4 | grep -E "/$(printf '%s' "$asset" | sed 's/\*/[^/]*/g')$" | head -n1)
+url=$(printf '%s' "$json" | tr ',' '\n' | grep -o '"browser_download_url": *"[^"]*"' | cut -d'"' -f4 | grep -E "/netgrip_[^/]*_${arch}\.ipk$" | head -n1)
 [ -n "$url" ] || { log "no release asset matching $asset"; exit 1; }
 
 # Never downgrade a dev build: only heal when the asset matches the