diff --git a/install.sh b/install.sh
index 2a99a69..653587b 100755
--- a/install.sh
+++ b/install.sh
@@ -106,7 +106,15 @@ fi
 # ── Restart middlewared ───────────────────────────────────────────────────────
 
 echo "Restarting middlewared so the backend patch takes effect ..."
-systemctl restart middlewared
+if ! systemctl restart middlewared; then
+    echo "" >&2
+    echo "ERROR: middlewared failed to restart. The patch files are installed but" >&2
+    echo "the hook is not yet active. Check the system log for the root cause:" >&2
+    echo "  journalctl -u middlewared -n 50" >&2
+    echo "If the problem is unrelated to this patch, recover with:" >&2
+    echo "  bash $PATCH_DIR/recover.sh" >&2
+    exit 1
+fi
 echo "Done."
 echo ""
 echo "Refresh your browser to pick up the UI change."
diff --git a/patch/create_task.py b/patch/create_task.py
index 7cb8116..8869199 100755
--- a/patch/create_task.py
+++ b/patch/create_task.py
@@ -195,7 +195,9 @@ def main():
     p.add_argument("--api-key", default=None, metavar="KEY",
                    help="TrueNAS API key — System → API Keys (required except for verify)")
     p.add_argument("--insecure", action="store_true",
-                   help="Skip TLS certificate verification (self-signed certs)")
+                   help="Skip TLS certificate verification (self-signed certs). "
+                        "WARNING: exposes your API key to network interception. "
+                        "Prefer adding your cert to the trust store instead.")
 
     sub = p.add_subparsers(dest="cmd", required=True)