diff --git a/site-cookbooks/kosmos-hubot/resources/bot.rb b/site-cookbooks/kosmos-hubot/resources/bot.rb
index ca665b3..abedfd4 100644
--- a/site-cookbooks/kosmos-hubot/resources/bot.rb
+++ b/site-cookbooks/kosmos-hubot/resources/bot.rb
@@ -54,7 +54,7 @@ action :create do
     group      app_group
     repository new_resource.repository
     revision   new_resource.revision
-    notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
+    notifies :restart, "service[#{app_name}]", :delayed
   end
 
   execute "npm install (#{app_name})" do
@@ -123,6 +123,14 @@ action :create do
     content unit
     verify false
     triggers_reload true
-    action [:create, :enable, :start]
+    action [:create, :enable]
+  end
+
+  # `systemd_unit` only reloads the daemon and never restarts a running unit, so
+  # unit/env changes would not take effect until the next repo change or reboot.
+  # Restart whenever the unit file changes.
+  service app_name do
+    action [:enable, :start]
+    subscribes :restart, "systemd_unit[#{app_name}.service]", :delayed
   end
 end
diff --git a/site-cookbooks/kredits-github/recipes/default.rb b/site-cookbooks/kredits-github/recipes/default.rb
index 5316e44..e74a507 100644
--- a/site-cookbooks/kredits-github/recipes/default.rb
+++ b/site-cookbooks/kredits-github/recipes/default.rb
@@ -32,7 +32,7 @@ git app_path do
   group deploy_group
   repository "https://github.com/67P/#{app_name}.git"
   revision   node[app_name]['revision']
-  notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 execute "npm install" do
@@ -54,6 +54,10 @@ service_env = {
   # Bind on all interfaces so the openresty reverse proxy (draco/fornax) can
   # reach the app over ZeroTier; port 3000 is firewalled to 10.1.1.0/24 below.
   "HOST" => '0.0.0.0',
+  # Probot 14 changed its default webhook path from "/" (Probot 7) to
+  # "/api/github/webhooks". The GitHub App is still configured to POST to
+  # "https://kredits-github.kosmos.org/", so keep serving there.
+  "WEBHOOK_PATH" => '/',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
   "WEBHOOK_SECRET" => credentials["webhook_secret"]
@@ -80,7 +84,15 @@ systemd_unit "#{app_name}.service" do
   })
   verify false
   triggers_reload true
-  action [:create, :enable, :start]
+  action [:create, :enable]
+end
+
+# `systemd_unit` only reloads the daemon and never restarts a running unit, so
+# unit/env changes would not take effect until the next repo change or reboot.
+# Restart whenever the unit file changes.
+service app_name do
+  action [:enable, :start]
+  subscribes :restart, "systemd_unit[#{app_name}.service]", :delayed
 end
 
 unless node.chef_environment == "development"