diff --git a/src/Scripts/apply-patches.sh b/src/Scripts/apply-patches.sh
index fdbc7e9..b543204 100644
--- a/src/Scripts/apply-patches.sh
+++ b/src/Scripts/apply-patches.sh
@@ -105,7 +105,11 @@ fi
 mapfile -t _all_modules < <(list_modules)
 _target_modules=("${@:-${_all_modules[@]}}")
 for mod in "${_target_modules[@]}"; do
-    [[ "$(read_conf "$MAIN_CONF" modules "$mod" 0)" == "1" ]] || continue
+    # When modules are explicitly named as args, the caller decides what to apply.
+    # When running for all modules (no args from dpkg trigger), respect the config.
+    if [[ $# -eq 0 ]]; then
+        [[ "$(read_conf "$MAIN_CONF" modules "$mod" 0)" == "1" ]] || continue
+    fi
 
     mod_dir="$PATCHES_DIR/$mod"
     manifest="$mod_dir/patches.list"
diff --git a/src/Scripts/pve-mod-configure b/src/Scripts/pve-mod-configure
index 1a571de..695de3d 100644
--- a/src/Scripts/pve-mod-configure
+++ b/src/Scripts/pve-mod-configure
@@ -632,19 +632,20 @@ main() {
     esac
 
     # ── Write config and apply/revert ─────────────────────────────────────────
-    write_config
-
     # For mods with patches: apply if being enabled, revert if being disabled.
     # Option 3 (pve_trigger) has no patches — write_config is sufficient.
-    if [[ -n "$selected_mod" ]]; then
-        if [[ "$patching_needed" == "1" ]]; then
-            msgb "\n=== Applying patches ==="
-            "$APPLY_PATCHES" "$selected_mod"
-        else
-            msgb "\n=== Removing patches ==="
-            "$REVERT_PATCHES" "$selected_mod"
+    if [[ "$patching_needed" == "1" ]]; then
+        msgb "\n=== Applying patches ==="
+        if ! "$APPLY_PATCHES" "$selected_mod"; then
+            err "Could not apply all patches for $selected_mod. Configuration was not updated."
+        fi
+    elif [[ -n "$selected_mod" ]]; then
+        msgb "\n=== Removing patches ==="
+        if ! "$REVERT_PATCHES" "$selected_mod"; then
+            err "Could not revert all patches for $selected_mod. Configuration was not updated."
         fi
     fi
+    write_config
 
     msgb "\n=== Done ==="
     info "pve-mod is configured and active."
diff --git a/src/Scripts/revert-patches.sh b/src/Scripts/revert-patches.sh
index 8fc0a90..584bec4 100644
--- a/src/Scripts/revert-patches.sh
+++ b/src/Scripts/revert-patches.sh
@@ -39,7 +39,7 @@ revert_one_patch() {
     fi
     warn "  $(basename "$patch") could not be reverted cleanly; manual cleanup may be needed"
     patch -R -p1 -F0 -f --dry-run --verbose -d "$PVE_MOD_ROOT" < "$patch" >&2 || true
-    return 1
+    return 2
 }
 
 # ── main ──────────────────────────────────────────────────────────────────────
@@ -51,6 +51,7 @@ fi
 [[ -d "$PATCHES_DIR" ]] || exit 0
 
 CHANGED=false
+FAILED=false
 
 mapfile -t _all_modules < <(for d in "$PATCHES_DIR"/*/; do [[ -d "$d" ]] && basename "$d"; done)
 _target_modules=("${@:-${_all_modules[@]}}")
@@ -90,9 +91,13 @@ for mod in "${_target_modules[@]}"; do
         patch_name="${patches[$i]}"
         patch_file="$mod_dir/$patch_name"
         [[ -f "$patch_file" ]] || continue
-        if revert_one_patch "$patch_file"; then
+        revert_one_patch "$patch_file"
+        rc=$?
+        if [[ "$rc" -eq 0 ]]; then
             info "  reverted $patch_name"
             CHANGED=true
+        elif [[ "$rc" -eq 2 ]]; then
+            FAILED=true
         fi
     done
 done
@@ -101,4 +106,6 @@ if [[ "$CHANGED" == "true" ]]; then
     info "Restarting pveproxy..."
     systemctl restart pveproxy 2>/dev/null || true
 fi
+
+[[ "$FAILED" == "false" ]] || exit 1
 exit 0