diff --git a/apps/base/puppet/resources/additional-ruby-gems.sh b/apps/base/puppet/resources/additional-ruby-gems.sh
index 3ce798a..040238e 100755
--- a/apps/base/puppet/resources/additional-ruby-gems.sh
+++ b/apps/base/puppet/resources/additional-ruby-gems.sh
@@ -1,9 +1,29 @@
 #!/bin/bash
-set -e
+# No `set -e`: the entrypoint runs post-startup hooks under errexit, so a non-zero
+# exit here kills an already-serving compiler. Failures are logged, not fatal.
+set -uo pipefail
+
+rc=0
+
+install_gem() {
+  local label=$1
+  shift
+  if ! "$@"; then
+    echo "ERROR: ${label} gem install failed: $*" >&2
+    rc=1
+  fi
+}
 
 echo "Installing additional Ruby gems..."
-/opt/puppetlabs/puppet/bin/gem install deep_merge
-/opt/puppetlabs/puppet/bin/gem install ipaddr
-/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
-/opt/puppetlabs/puppet/bin/gem install toml
-echo "Additional Ruby gems installed successfully"
+for gem in deep_merge ipaddr hiera-eyaml toml; do
+  install_gem agent /opt/puppetlabs/puppet/bin/gem install "$gem"
+done
+
+# Server-side functions load from the puppetserver JRuby gem path, not the agent one.
+install_gem puppetserver /opt/puppetlabs/bin/puppetserver gem install toml
+
+if [ "$rc" -ne 0 ]; then
+  echo "ERROR: additional Ruby gems incomplete; catalog compiles may fail" >&2
+else
+  echo "Additional Ruby gems installed successfully"
+fi