diff --git a/modules/dev.py b/modules/dev.py
index f54b99c..49cc425 100644
--- a/modules/dev.py
+++ b/modules/dev.py
@@ -42,6 +42,12 @@ class DevModule(Module):
 
     def after_update(self, store):
         for pkg in BUN_GLOBAL_PACKAGES:
-            decman.prg(["su", "-", self.user, "-c", f"bun add -g {pkg}"])
+            try:
+                decman.prg(["su", "-", self.user, "-c", f"bun add -g {pkg}"])
+            except Exception:
+                print(f"警告：安装 {pkg} 失败，跳过")
         for pkg in GO_INSTALL_PACKAGES:
-            decman.prg(["su", "-", self.user, "-c", f"go install {pkg}"])
+            try:
+                decman.prg(["su", "-", self.user, "-c", f"go install {pkg}"])
+            except Exception:
+                print(f"警告：安装 {pkg} 失败，跳过")
diff --git a/modules/docker.py b/modules/docker.py
index 3f1d0eb..8addfd7 100644
--- a/modules/docker.py
+++ b/modules/docker.py
@@ -1,6 +1,8 @@
+import subprocess
+
 import decman
 from decman import Module
-from decman.plugins.pacman import packages
+from decman.plugins.pacman import packages as pacman_packages
 from decman.plugins.systemd import units
 
 
@@ -9,13 +11,19 @@ class DockerModule(Module):
         super().__init__("docker")
         self.user = user
 
-    @packages
-    def packages(self) -> set[str]:
+    @pacman_packages
+    def pacman_packages(self) -> set[str]:
         return {"docker", "docker-compose"}
 
     @units
     def units(self) -> set[str]:
         return {"docker.socket"}
 
-    def on_enable(self, store):
-        decman.prg(["gpasswd", "-a", self.user, "docker"])
+    def after_update(self, store):
+        result = subprocess.run(
+            ["id", "-nG", self.user], capture_output=True, text=True
+        )
+        if result.returncode != 0:
+            return
+        if "docker" not in result.stdout.split():
+            decman.prg(["gpasswd", "-a", self.user, "docker"])
diff --git a/modules/wsl.py b/modules/wsl.py
index 51c62e2..1715f13 100644
--- a/modules/wsl.py
+++ b/modules/wsl.py
@@ -1,3 +1,5 @@
+import subprocess
+
 import decman
 from decman import Module
 
@@ -6,5 +8,18 @@ class WslModule(Module):
     def __init__(self):
         super().__init__("wsl")
 
-    def on_enable(self, store):
-        decman.prg(["systemctl", "mask", "systemd-networkd-wait-online.service"])
+    def after_update(self, store):
+        try:
+            result = subprocess.run(
+                ["systemctl", "is-enabled", "systemd-networkd-wait-online.service"],
+                capture_output=True,
+                text=True,
+            )
+            if result.stdout.strip() != "masked":
+                decman.prg(
+                    ["systemctl", "mask", "systemd-networkd-wait-online.service"]
+                )
+        except Exception:
+            print(
+                "警告：systemd 不可用，跳过 mask systemd-networkd-wait-online.service"
+            )
diff --git a/modules/zsh.py b/modules/zsh.py
index d9c1a37..1f70745 100644
--- a/modules/zsh.py
+++ b/modules/zsh.py
@@ -1,3 +1,5 @@
+import subprocess
+
 import decman
 from decman import File, Module
 from decman.plugins.aur import packages as aur_packages
@@ -38,5 +40,13 @@ class ZshModule(Module):
             "oh-my-zsh-git",
         }
 
-    def on_enable(self, store):
-        decman.prg(["chsh", "-s", "/usr/bin/zsh", self.user])
+    def after_update(self, store):
+        result = subprocess.run(
+            ["getent", "passwd", self.user], capture_output=True, text=True
+        )
+        if result.returncode != 0:
+            return
+        # passwd 格式: name:x:uid:gid:gecos:home:shell
+        shell = result.stdout.strip().split(":")[-1]
+        if shell != "/usr/bin/zsh":
+            decman.prg(["chsh", "-s", "/usr/bin/zsh", self.user])
diff --git a/scripts/install.sh b/scripts/install.sh
index 2523b11..bbe4ea8 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -4,13 +4,17 @@ set -euo pipefail
 REPO_URL="https://git.furtherverse.com/imbytecat/archlinux-config.git"
 CONFIG_DIR="$HOME/.config/archlinux-config"
 
+echo "==> 验证 sudo 权限..."
+sudo -v < /dev/tty || { echo "错误：需要 sudo 权限，请确认当前用户已配置 sudo"; exit 1; }
+
 echo "==> 安装 git..."
 sudo pacman -S --needed --noconfirm git
 
 echo "==> 克隆配置仓库..."
-if [ -d "$CONFIG_DIR/.git" ]; then
+mkdir -p "$(dirname "$CONFIG_DIR")"
+if [[ -d "$CONFIG_DIR/.git" ]]; then
     echo "配置仓库已存在：$CONFIG_DIR，跳过克隆"
-elif [ -e "$CONFIG_DIR" ]; then
+elif [[ -e "$CONFIG_DIR" ]]; then
     echo "目标路径已存在且不是 git 仓库：$CONFIG_DIR"
     exit 1
 else
diff --git a/scripts/wsl-init.sh b/scripts/wsl-init.sh
index 48164e4..e162e39 100755
--- a/scripts/wsl-init.sh
+++ b/scripts/wsl-init.sh
@@ -18,8 +18,13 @@ if [ -z "$USERNAME" ]; then
     exit 1
 fi
 
-echo "==> 同步数据库并安装 sudo..."
-pacman -Sy --needed --noconfirm sudo
+echo "==> 更新系统..."
+pacman -Syu --noconfirm
+
+if ! command -v sudo &> /dev/null; then
+    echo "==> 安装 sudo..."
+    pacman -S --needed --noconfirm sudo
+fi
 
 echo "==> 配置 sudo 权限..."
 cat > /etc/sudoers.d/10-wheel << 'EOF'
@@ -29,7 +34,8 @@ chmod 440 /etc/sudoers.d/10-wheel
 
 echo "==> 创建用户 $USERNAME..."
 if id "$USERNAME" &> /dev/null; then
-    echo "用户 $USERNAME 已存在，跳过创建"
+    echo "用户 $USERNAME 已存在，确保 wheel 组成员"
+    usermod -aG wheel "$USERNAME"
 else
     useradd -m -G wheel -s /bin/bash "$USERNAME"
     echo "请设置 $USERNAME 的密码："