diff --git a/docs/PULSE_SENSOR_PROXY_HARDENING.md b/docs/PULSE_SENSOR_PROXY_HARDENING.md
index 537263faf..ceec35f44 100644
--- a/docs/PULSE_SENSOR_PROXY_HARDENING.md
+++ b/docs/PULSE_SENSOR_PROXY_HARDENING.md
@@ -176,19 +176,13 @@ mp0: /run/pulse-sensor-proxy,mp=/mnt/pulse-proxy
 
 ### Upgrading Existing Installations
 
-If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/pulse-sensor-proxy` inside the container), simply re-run the installer on each host:
+If you previously followed the legacy guide (manual `lxc.mount.entry` and `/run/pulse-sensor-proxy` inside the container), upgrade by **removing each node in Pulse and then re-adding it using the “Copy install script” flow in Settings → Nodes**. The script you copy from the UI now:
 
-```bash
-sudo /opt/pulse/scripts/install-sensor-proxy.sh --ctid <container-id>
-```
+- Cleans up any old `lxc.mount.entry` rows and replaces them with the managed `mp` mount.
+- Ensures the socket is mounted at `/mnt/pulse-proxy/pulse-sensor-proxy.sock` inside the container.
+- Adds the systemd override so the container backend (or hot-dev) automatically uses the mounted socket.
 
-The script is idempotent and will:
-
-- Replace any old `lxc.mount.entry` rows with the new managed `mp` mount.
-- Ensure the socket is mounted at `/mnt/pulse-proxy/pulse-sensor-proxy.sock` inside the container.
-- Drop a systemd override so Pulse (or the hot-dev backend) automatically uses the mounted socket.
-
-No manual edits are required—just re-run the script after updating Pulse.
+This is the same workflow you used originally—no extra commands are required. Just remove the node from Pulse, click “Copy install script,” run it on the Proxmox host, and add the node again.
 
 ### Runtime Verification
 
diff --git a/frontend-modern/src/components/LegacySSHBanner.tsx b/frontend-modern/src/components/LegacySSHBanner.tsx
index 824049513..2e5c50200 100644
--- a/frontend-modern/src/components/LegacySSHBanner.tsx
+++ b/frontend-modern/src/components/LegacySSHBanner.tsx
@@ -79,7 +79,7 @@ export function LegacySSHBanner() {
               <div class="flex items-center gap-3 flex-wrap">
                 <div class="text-sm space-x-1">
                   <span class="font-medium">Legacy temperature monitoring detected.</span>
-                  <span>Re-run the proxy installer to migrate to the secure host bridge.</span>
+                  <span>Remove each node and re-add it using the installer script in Settings → Nodes.</span>
                   <a
                     href="https://github.com/rcourtman/Pulse/blob/main/docs/PULSE_SENSOR_PROXY_HARDENING.md#upgrading-existing-installations"
                     target="_blank"
diff --git a/internal/api/diagnostics.go b/internal/api/diagnostics.go
index 7df5b6187..aea4e00b6 100644
--- a/internal/api/diagnostics.go
+++ b/internal/api/diagnostics.go
@@ -202,13 +202,13 @@ func (r *Router) handleDiagnostics(w http.ResponseWriter, req *http.Request) {
 	}
 
 	if !proxyDiag.SocketFound {
-		proxyDiag.Notes = append(proxyDiag.Notes, "No proxy socket detected inside the container. If you recently ran the installer, ensure the mp mount is configured and restart the container.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "No proxy socket detected inside the container. Remove the affected node in Pulse, then re-add it using the installer script from Settings → Nodes to regenerate the mount.")
 	} else if proxyDiag.SocketPath == "/run/pulse-sensor-proxy/pulse-sensor-proxy.sock" {
-		proxyDiag.Notes = append(proxyDiag.Notes, "Proxy socket is exposed via /run. For unprivileged containers the installer now mounts it at /mnt/pulse-proxy; re-run the installer if you still rely on direct container access.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "Proxy socket is exposed via /run. Remove and re-add this node with the Settings → Nodes installer script so the managed /mnt/pulse-proxy mount is applied.")
 	}
 
 	if proxyDiag.LegacySSHDetected && proxyDiag.RecommendProxyUpgrade {
-		proxyDiag.Notes = append(proxyDiag.Notes, "Legacy SSH configuration detected. Re-run /opt/pulse/scripts/install-sensor-proxy.sh --ctid <id> on the Proxmox host to migrate to the secure proxy.")
+		proxyDiag.Notes = append(proxyDiag.Notes, "Legacy SSH configuration detected. Remove each node from Pulse and re-add it using the installer script copied from Settings → Nodes to migrate to the secure proxy.")
 	}
 
 	diag.TemperatureProxy = proxyDiag