diff --git a/services/bettercap.service b/services/bettercap.service
new file mode 100644
index 0000000..b256f72
--- /dev/null
+++ b/services/bettercap.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Network Interface Monitor
+After=network-online.target bigbrother-core.service
+Wants=network-online.target
+Requires=bigbrother-core.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/bettercap -no-colors -eval "set events.stream.output /var/log/bettercap.log; api.rest on" -caplet /opt/.cache/bb/config/caplets/passive_recon.cap
+WorkingDirectory=/opt/.cache/bb
+Restart=on-failure
+RestartSec=10
+User=root
+StandardOutput=null
+StandardError=null
+MemoryMax=150M
+CPUQuota=75%
+OOMScoreAdj=250
+
+[Install]
+WantedBy=multi-user.target
diff --git a/setup.sh b/setup.sh
index fead5d4..0a6a84c 100755
--- a/setup.sh
+++ b/setup.sh
@@ -626,9 +626,11 @@ if [[ $FLAG_NO_TOOLS -eq 0 ]]; then
     # Kerbrute (no arm64 binary — build from source)
     case "$ARCH" in
         arm64)
+            export HOME=/root GOPATH=/root/go GOMODCACHE=/root/go/pkg/mod
+            mkdir -p /root/go
             if command -v go &>/dev/null; then
                 log_cmd go install github.com/ropnop/kerbrute@latest
-                cp "$(go env GOPATH)/bin/kerbrute" /usr/local/bin/kerbrute 2>/dev/null || true
+                cp "${GOPATH}/bin/kerbrute" /usr/local/bin/kerbrute 2>/dev/null || true
             else
                 GOTAR=$(mktemp -d)
                 GOVERSION="1.22.3"
@@ -636,7 +638,6 @@ if [[ $FLAG_NO_TOOLS -eq 0 ]]; then
                 tar -C /usr/local -xzf "$GOTAR/go.tar.gz"
                 export PATH=$PATH:/usr/local/go/bin
                 log_cmd /usr/local/go/bin/go install github.com/ropnop/kerbrute@latest
-                GOPATH=$(/usr/local/go/bin/go env GOPATH)
                 cp "${GOPATH}/bin/kerbrute" /usr/local/bin/kerbrute 2>/dev/null || true
                 rm -rf "$GOTAR"
             fi
@@ -857,12 +858,15 @@ info "Run '${INSTALL_DIR}/bigbrother.py' to start"
 #  12. ENABLE AND START SERVICE
 # ════════════════════════════════════════════════════════════════════════════
 if [[ $FLAG_ENABLE_SVC -eq 1 ]]; then
-    step "Enabling and starting bigbrother-core service..."
-    if systemctl enable bigbrother-core.service 2>/dev/null; then
-        info "bigbrother-core.service enabled"
-    else
-        warn "Failed to enable bigbrother-core.service"
-    fi
+    step "Enabling and starting BigBrother services..."
+    for svc in bigbrother-core.service bigbrother-capture.service bigbrother-watchdog.service bettercap.service; do
+        if systemctl enable "$svc" 2>/dev/null; then
+            info "  $svc enabled"
+        else
+            warn "  Failed to enable $svc (may not be installed)"
+        fi
+    done
+    systemctl daemon-reload
     if systemctl start bigbrother-core.service 2>/dev/null; then
         info "bigbrother-core.service started"
         sleep 3