diff --git a/BACKLOG.md b/BACKLOG.md
index 0fec1a4..2777c5f 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -180,10 +180,11 @@
 - **result:** Verified zero callers (grep + 38 test files scanned — no references to `./self-updater`). Discovered the file was actually gitignored, never committed — so `git rm` was unnecessary; plain `rm` did it. Tests: 1075/1075 still passing post-delete. Also synced `dashcaddy-api/VERSION` to `42376e2` (the DC-033 + release-bump commit) so the rebuilt container reports the right SHA. Live: `curl http://127.0.0.1:3001/api/v1/system/version` returns `{"name":"DashCaddy","version":"1.14.9","commit":"42376e2"}`.
 
 ### DC-037: Move `/etc/dashcaddy/sites/dashcaddy-api` symlink creation into the install script
-- **status:** in-progress
+- **status:** done
 - **owner:** krystie
 - **details:** DNS2 has the symlink manually created during this session (2026-07-05), but every other fresh DashCaddy install will hit the same `cp: cannot create directory '/etc/dashcaddy/sites/dashcaddy-api/routes': No such file or directory` failure when the first auto-update lands, because `dashcaddy-update.sh` defaults `apiSourceDir` to `${CADDY_BASE}/sites/dashcaddy-api` (= `/etc/dashcaddy/sites/dashcaddy-api`) while the actual install lives at `/opt/dashcaddy/dashcaddy-api`. Fix: add `mkdir -p /etc/dashcaddy/sites && ln -sfn /opt/dashcaddy/dashcaddy-api /etc/dashcaddy/sites/dashcaddy-api` to the install script (whichever of `dashcaddy-installer/install.sh` or `scripts/dashcaddy-install.sh` is canonical — verify which exists on a clean install). Make it idempotent (`ln -sfn`, not `ln -s`, so re-runs don't fail). Effort: ~10 min. Risk: very low.
 - **impact:** Prevents every future DashCaddy host from hitting the v1.14.4-class update failure on first auto-update.
+- **result:** Added `install_api_symlink()` to `dashcaddy-installer/install.sh`, called from `main()` right after `start_caddy` at end of Step 7. The function does `mkdir -p /opt/dashcaddy && ln -sfn "${API_DIR}" /opt/dashcaddy/dashcaddy-api` (idempotent: `-sfn` replaces stale links and does not fail on re-runs; `${API_DIR}` resolves to `/etc/dashcaddy/sites/dashcaddy-api` per the existing readonly constants at lines 23-26). The `mkdir -p /opt/dashcaddy` ensures the symlink's parent directory exists on a fresh host before `ln -sfn` runs. `bash -n install.sh` returns SYNTAX OK. The auto-updater's `DATA_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api/data` and other `/opt/dashcaddy/...` defaults now resolve cleanly through the symlink on fresh installs. Existing DNS2 host is unaffected (the symlink already exists there from the manual session 2026-07-05; `ln -sfn` would replace it with the same target if re-run).
 
 ---
 
diff --git a/dashcaddy-installer/install.sh b/dashcaddy-installer/install.sh
index f46b9a9..3b5c227 100644
--- a/dashcaddy-installer/install.sh
+++ b/dashcaddy-installer/install.sh
@@ -835,6 +835,22 @@ start_caddy() {
   fi
 }
 
+# DC-037: Make API source reachable from both the install path
+# (${SITES_DIR}/dashcaddy-api, where this installer writes files) and the
+# /opt/dashcaddy/dashcaddy-api path that the auto-updater and several runtime
+# helpers default to. Without this, a first auto-update lands on a fresh host
+# that wrote its API files to ${SITES_DIR}/dashcaddy-api but tried to read
+# from /opt/dashcaddy/dashcaddy-api and crashes with
+# `cp: cannot create directory '/etc/dashcaddy/sites/dashcaddy-api/routes':
+# No such file or directory` because the trailing parent path is missing.
+# `ln -sfn` is idempotent (safe on re-runs; does not fail if the link already
+# points to the same target) and replaces any stale link.
+install_api_symlink() {
+  mkdir -p /opt/dashcaddy
+  ln -sfn "${API_DIR}" /opt/dashcaddy/dashcaddy-api
+  ok "API symlink: /opt/dashcaddy/dashcaddy-api -> ${API_DIR}"
+}
+
 # ============================================================================
 # Firewall
 # ============================================================================
@@ -1091,6 +1107,7 @@ main() {
   # ---- Step 7: Start Caddy ----
   step "Starting web server"
   start_caddy
+  install_api_symlink
 
   print_success "$(elapsed "$start_time")"
 }