diff --git a/internal/native/native.go b/internal/native/native.go
index 6e37fa5..a4f5e25 100644
--- a/internal/native/native.go
+++ b/internal/native/native.go
@@ -16,6 +16,7 @@ import (
 const (
 	BaseDir         = "/opt/wallarm"
 	NodesDir        = BaseDir + "/nodes"
+	NginxDir        = BaseDir + "/nginx"
 	SystemdTemplate = "/etc/systemd/system/wallarm-node@.service"
 )
 
@@ -100,7 +101,7 @@ WALLARM_CONFIG_PATH=%s
 		return fmt.Errorf("extract installer: %w\n%s", err, string(out))
 	}
 
-	// 6. Run setup.sh in batch mode (non-interactive)
+	// 6. Run setup.sh in batch mode
 	setupScript := filepath.Join(workDir, "setup.sh")
 	if _, err := os.Stat(setupScript); err != nil {
 		return fmt.Errorf("setup.sh not found after extraction: %w", err)
@@ -234,15 +235,26 @@ func CreateNodesDir() error {
 	return os.MkdirAll(NodesDir, 0755)
 }
 
-// installNginx ensures NGINX is present on the system.
+// installNginx ensures a dedicated NGINX is present under /opt/wallarm/nginx/.
 // Tries apt, yum, dnf, apk — prints clear error if all fail.
 func installNginx() {
+	nginxBin := NginxDir + "/sbin/nginx"
+	if _, err := os.Stat(nginxBin); err == nil {
+		return // already installed
+	}
+
+	fmt.Println("Installing NGINX under", NginxDir, "...")
+
+	// Try common package managers to get the nginx binary, then relocate
 	if _, err := exec.LookPath("nginx"); err == nil {
+		// System has nginx, copy the binary
+		os.MkdirAll(NginxDir+"/sbin", 0755)
+		exec.Command("cp", "/usr/sbin/nginx", nginxBin).Run()
+		fmt.Println("  Copied from system.")
 		return
 	}
-	fmt.Println("Installing NGINX (required by Wallarm node)...")
 
-	// Try common package managers
+	// Try installing via package managers
 	for _, pm := range [][]string{
 		{"apt-get", "update", "-qq"},
 		{"apt-get", "install", "-y", "-qq", "nginx"},
@@ -251,20 +263,18 @@ func installNginx() {
 		{"apk", "add", "--no-cache", "nginx"},
 	} {
 		if _, err := exec.LookPath(pm[0]); err == nil {
-			cmd := exec.Command(pm[0], pm[1:]...)
-			if out, err := cmd.CombinedOutput(); err == nil {
+			exec.Command(pm[0], pm[1:]...).Run()
+			if _, err := os.Stat("/usr/sbin/nginx"); err == nil {
+				os.MkdirAll(NginxDir+"/sbin", 0755)
+				exec.Command("cp", "/usr/sbin/nginx", nginxBin).Run()
+				os.MkdirAll(NginxDir+"/conf", 0755)
 				fmt.Println("  Installed via", pm[0])
 				return
-			} else {
-				_ = out
 			}
 		}
 	}
 
-	// If all fail, print instructions
-	fmt.Println("Could not install NGINX automatically.")
-	fmt.Println("Install it manually: apt-get install nginx")
-	fmt.Println("Then re-run the deployment.")
+	fmt.Println("Could not install NGINX. Install it manually to", NginxDir)
 }
 
 // cloudFromHost maps API host to cloud region code (US/EU/ME).