diff --git a/config/nvim/lua/plugins/lsp.lua b/config/nvim/lua/plugins/lsp.lua
index 00d97db..edc4f2b 100644
--- a/config/nvim/lua/plugins/lsp.lua
+++ b/config/nvim/lua/plugins/lsp.lua
@@ -1,4 +1,21 @@
-local servers = { "basedpyright", "ruff" }
+-- ruff is a prebuilt GitHub release binary, but mason installs basedpyright
+-- from PyPI into a venv. Debian ships venv's ensurepip separately
+-- (python3-venv), and without it every startup fails the install.
+local servers = { "ruff" }
+
+local function has_python_venv()
+  if vim.fn.executable("python3") ~= 1 then
+    return false
+  end
+  vim.fn.system({ "python3", "-c", "import ensurepip" })
+  return vim.v.shell_error == 0
+end
+
+if has_python_venv() then
+  table.insert(servers, "basedpyright")
+else
+  vim.notify("python3 venv unavailable (install python3-venv): skipping LSP server basedpyright", vim.log.levels.WARN)
+end
 
 local npm_servers = { "ts_ls", "svelte", "html", "cssls", "bashls" }
 local function has_public_npm()
diff --git a/packages/apt.global b/packages/apt.global
index 4165096..a96e27a 100644
--- a/packages/apt.global
+++ b/packages/apt.global
@@ -6,6 +6,9 @@ powerline
 thefuck
 tree
 nodejs
+# Debian splits venv's ensurepip out of python3; mason needs `python3 -m venv`
+# to install PyPI-sourced LSP servers (basedpyright)
+python3-venv
 zsh
 htop
 jq