diff --git a/owpengram-server.sh b/owpengram-server.sh
index 5baa3e6c..7c4c956e 100755
--- a/owpengram-server.sh
+++ b/owpengram-server.sh
@@ -110,6 +110,29 @@ if [[ "$PROBLEMS" -ne 0 ]]; then
   OWPENGRAM_PREREQS_TRIED=1 exec "$0" "$@"
 fi
 
+# --- Docker group ------------------------------------------------------------
+# usermod -aG docker only changes what a *new* login gets: the shell that just
+# ran the installer still has the old group set, so the panel's first
+# `docker compose up` dies with "permission denied while trying to connect to
+# the docker API at unix:///var/run/docker.sock". sg re-enters this script with
+# the group applied and needs no logout, so the install-then-start run works in
+# one go. Matched on the exact symptom -- a daemon that is simply not running is
+# a different problem and must not be swallowed here.
+if [[ -z "${OWPENGRAM_SG_DOCKER:-}" && $EUID -ne 0 ]] && command -v docker >/dev/null 2>&1; then
+  DOCKER_ERR="$(docker version 2>&1 >/dev/null || true)"
+  if [[ "$DOCKER_ERR" == *"permission denied"* ]] &&
+     getent group docker 2>/dev/null | grep -qE "[:,]${USER}(,|$)"; then
+    if command -v sg >/dev/null 2>&1; then
+      echo "[..] Applying your new 'docker' group membership for this run"
+      export OWPENGRAM_SG_DOCKER=1
+      exec sg docker -c "$(printf '%q ' "$0" "$@")"
+    fi
+    echo
+    die "you were added to the 'docker' group, but this shell still has the old one --
+       log out and back in (or run 'newgrp docker'), then re-run this script"
+  fi
+fi
+
 echo
 echo "[cfg] All prerequisites OK."
 echo
diff --git a/scripts/install-prereqs.ps1 b/scripts/install-prereqs.ps1
index 2c19c826..4d3a5bf8 100644
--- a/scripts/install-prereqs.ps1
+++ b/scripts/install-prereqs.ps1
@@ -136,6 +136,13 @@ if ($DryRun) {
 }
 
 if ($needed.Count -gt 0 -and -not $Yes) {
+    # Without a console there is nobody to answer, and Read-Host would block for
+    # as long as the caller is willing to wait -- forever, for a CI job or a
+    # wrapping script. Say so instead of hanging.
+    if ([Console]::IsInputRedirected) {
+        Write-Err 'no console to confirm on -- re-run with -Yes to install without asking, or -DryRun to only look'
+        exit 1
+    }
     $answer = Read-Host 'Install these now? [Y/n]'
     if ($answer -and $answer -notmatch '^(y|yes)$') {
         Write-Err 'cancelled'
diff --git a/scripts/install-prereqs.sh b/scripts/install-prereqs.sh
index 101e4204..90328a05 100755
--- a/scripts/install-prereqs.sh
+++ b/scripts/install-prereqs.sh
@@ -114,6 +114,12 @@ if [[ "$DRY_RUN" -eq 1 ]]; then
 fi
 
 if [[ "$ASSUME_YES" -ne 1 ]]; then
+  # Without a terminal there is nobody to answer, and `read` would block for as
+  # long as the caller is willing to wait -- which for a CI job or a wrapping
+  # script is forever. Say so instead of hanging.
+  if [[ ! -t 0 ]]; then
+    die "no terminal to confirm on -- re-run with --yes to install without asking, or --dry-run to only look"
+  fi
   read -r -p "Install these now? This needs root. [Y/n] " answer
   case "${answer:-y}" in
     [Yy]|[Yy][Ee][Ss]|"") ;;
@@ -290,7 +296,8 @@ if [[ "$GO_NEEDS_NEW_SHELL" -eq 1 ]]; then
   echo "       export PATH=\$PATH:/usr/local/go/bin"
 fi
 if [[ "$DOCKER_NEEDS_RELOGIN" -eq 1 ]]; then
-  echo "     You were added to the 'docker' group. Log out and back in (or run"
-  echo "     'newgrp docker') before docker works without sudo."
+  echo "     You were added to the 'docker' group. Already-running shells keep the"
+  echo "     old one -- owpengram-server.sh re-enters itself with 'sg docker' so this"
+  echo "     run works anyway, but log out and back in before using docker elsewhere."
 fi
 echo "     Then start the server with: ./owpengram-server.sh"