diff --git a/web/assets/styles.css b/web/assets/styles.css
index 5feabd2..c5c507c 100644
--- a/web/assets/styles.css
+++ b/web/assets/styles.css
@@ -410,3 +410,22 @@ html.modal-open { overflow: hidden; }
   .admin-table--wide, .admin-table--audit { min-width: 46rem; }.otp-value-row .button { width: 100%; }
   .pagination { justify-content: stretch; }.pagination__info { width: 100%; }.pagination__buttons .button { flex: 1; }
 }
+
+/* The sudo prerequisites beside the "expect to run as root" checkbox. Two steps, and
+   the second cannot be run until the first is true, so they are numbered rather than
+   left as a paragraph. Deliberately plain: this is read on the machine it describes. */
+.root-access-steps {
+  margin: .55rem 0 0;
+  padding-left: 1.15rem;
+  color: var(--admin-muted);
+  font-size: .67rem;
+  line-height: 1.6;
+}
+.root-access-steps li { margin-bottom: .5rem; }
+.root-access-steps strong { color: #e2e8f0; font-weight: 700; }
+.root-access-steps code {
+  color: var(--admin-lilac);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: .95em;
+  word-break: break-all;
+}
diff --git a/web/uadmin/nodes.html b/web/uadmin/nodes.html
index 16bf71c..032c458 100644
--- a/web/uadmin/nodes.html
+++ b/web/uadmin/nodes.html
@@ -142,14 +142,35 @@
               <label for="node-as-root">
                 Expect to run as root on an exclusive machine
               </label>
-              <small class="field-hint">
+              <small class="field-hint" id="root-access-hint">
                 Ticking this changes the command below to <code>curl … | sudo sh</code> and
-                installs to <code>/opt/umbra</code> with a system service running as its own
+                installs to <code>/opt/umbra</code> as a system service running as its own
                 <code>umbra-node</code> account. Unticked, everything stays in your home
-                directory with a user service. The script still checks for root when it
-                runs, so it does the right thing either way — but the paths it writes to
-                are chosen here, so a mismatch would fail.
+                directory with a user service and no password is needed.
               </small>
+              <ol class="root-access-steps">
+                <li>
+                  <strong>The account running the command must be in the
+                  <code>sudo</code> group.</strong> On a machine set up with a separate
+                  administrator and then a daily-use account, the first account created is
+                  the one that gets <code>sudo</code>; a later account does not. Check
+                  with <code>id -nG</code>. If <code>sudo</code> is not listed, an
+                  administrator adds it:
+                  <code>sudo usermod -aG sudo <var>account</var></code>
+                  then sign out and back in — group membership is fixed at sign-in.
+                </li>
+                <li>
+                  <strong>To avoid typing a password for every node</strong>, grant
+                  passwordless sudo for that one account. Run this
+                  <em>from an account that already has sudo</em>:
+                  <code>sudo visudo -f /etc/sudoers.d/umbra-node</code>
+                  then add this line and save:
+                  <code>umbra ALL=(ALL) NOPASSWD: ALL</code>
+                  Replace <code>umbra</code> with whichever account will run the command.
+                  Without this step the command still works — it will simply ask for a
+                  password each time.
+                </li>
+              </ol>
             </div>
 
             <div class="modal-actions">