diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44e30ff73a..e5f5dc1826 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,8 @@ All notable changes to this project will be documented in this file.
   - `doublezero connect Multicast` with N groups is one transaction in the common case (all groups sharing one publisher/subscriber flag pair fold into the create, skipping the activation wait); `doublezero multicast subscribe|unsubscribe|publish|unpublish`, `doublezero user subscribe`, and the role-strip cleanup in `user delete`/`request-ban` batch their role changes by flag pair, chunked to 16 groups per transaction. Failure reporting in the multicast verbs is per batch: a failed batch lists every group it carried, since none was applied. (malbeclabs/infra#2114)
   - `doublezero feed update|delete --force-unsubscribe` strips each user's orphaned groups with one batched role update per user (chunked to 16 groups per transaction) instead of one transaction per group. (malbeclabs/infra#2114)
   - `doublezero connect` obtains an RFC-27 IP ownership proof from the verification service and attaches it to user creation; the address the service observes is authoritative, and where it disagrees with the daemon's own discovery `connect` stops and names both. A verifier that is unreachable, unconfigured, or that declines is reported and the connect continues without a proof, which the program accepts until `require-ip-ownership-proof` is set; `--ip-verifier-url` or `DZ_IP_VERIFIER_URL` points at one, and no environment has a built-in default yet. (#4201)
+- Client
+  - From-source builds per `client/INSTALL.md` now succeed. `client/Makefile` defaulted `CARGO_FLAGS` to empty, so `make build` produced `target/debug/doublezero` while `make install` copied from `target/release/doublezero`, which never existed; `CARGO_FLAGS` now defaults to `--release` so the two agree. `make install` also called Debian-only `addgroup`/`adduser`, which are absent on RHEL/Rocky/Amazon Linux (in the documented support matrix), failing with `addgroup: command not found`; it now uses the portable `groupadd`/`useradd` with equivalent flags. (#4175)
 - Serviceability
   - `UpdateMulticastGroupRoles` (58) and `CreateSubscribeUser` (59) accept additional writable MulticastGroup accounts (counted by a new borsh-incremental `extra_group_count: u8` arg), so subscribing a user to N groups is one atomic transaction instead of N: one signature/fee, and a failure rolls back every group. Each batch member is authorized exactly like a single-group call (per-group allowlist checks; in `CreateSubscribeUser`, EdgeSeat extras are coverage-checked against the single passed feed and the seat still ticks once per user per feed, so a seat tick can no longer outlive a partial subscription). Duplicate group accounts in a batch are rejected. Old encodings without the count byte decode as 0, so existing clients are unaffected. Deploy ordering (RFC-1): the program must deploy to all clusters before any client that emits batches — an old program would misread the extra group accounts as the trailing optional accounts. (malbeclabs/infra#2114)
 - SDK
diff --git a/client/Makefile b/client/Makefile
index 001d8c59b0..c80fe53c9c 100644
--- a/client/Makefile
+++ b/client/Makefile
@@ -2,7 +2,7 @@ PREFIX:=github.com/malbeclabs/doublezero/smartcontract
 BUILD:=`git rev-parse --short HEAD`
 LDFLAGS=
 CLIPPY_FLAGS=-- -Dclippy::all -D warnings
-CARGO_FLAGS?=
+CARGO_FLAGS?=--release
 
 .PHONY: test
 test:
@@ -30,10 +30,10 @@ SYSTEMD_DIR ?= /usr/lib/systemd/system
 .PHONY: install
 install:
 	@if ! getent group doublezero >/dev/null 2>&1; then \
-		addgroup --system doublezero; \
+		groupadd --system doublezero; \
 	fi
 	@if ! getent passwd doublezero >/dev/null 2>&1; then \
-		adduser --system --ingroup doublezero --no-create-home --home /nonexistent doublezero; \
+		useradd --system --gid doublezero --no-create-home --home-dir /nonexistent --shell /bin/false doublezero; \
 	fi
 	install -d $(DESTDIR)$(BINDIR)
 	install -m 755 ../target/release/doublezero $(DESTDIR)$(BINDIR)/doublezero