diff --git a/AGENT.md b/AGENT.md
index 0c411a1..8dc9766 100644
--- a/AGENT.md
+++ b/AGENT.md
@@ -35,7 +35,7 @@ The old `deploy.sh` and `install.sh` are deprecated.
 5. Commit: `git add -A && git commit -m "description"`
 6. Tag: `git tag v$(cat VERSION)`
 7. Push: `git push origin main --tags`
-8. Deploy: `sudo bash ~/nextwks.sh --update`
+8. Deploy: `./nextwks.sh --update` (no sudo — script handles it per-command)
 
 > **Note:** The deploy script is downloaded by users via `curl` from the repo. For production deployment, users run:
 > ```bash
diff --git a/README.md b/README.md
index 748d454..fb20dca 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,8 @@ app.nextwks.eu :443                    auth.nextwks.eu :443
 curl -o ~/nextwks.sh https://git.lohmar.co.uk/lexton-it/NextWks/raw/branch/main/tools/nextwks.sh
 chmod +x ~/nextwks.sh
 
-# Run the installer
-sudo bash ~/nextwks.sh --install
+# Run the installer (no sudo — it'll ask only where needed)
+./nextwks.sh --install
 ```
 
 Prompts for domain, TLS email, and admin credentials. Installs deps (Go, Podman, git),
@@ -67,10 +67,10 @@ The script stays in `~/nextwks.sh` for future updates.
 
 ```bash
 # Smart update (pull, build, copy, restart)
-sudo bash ~/nextwks.sh --update
+./nextwks.sh --update
 
 # Full redeploy (tear down, rebuild from scratch with saved secrets)
-sudo bash ~/nextwks.sh --destroy
+./nextwks.sh --destroy
 ```
 
 ## Workflow (Development)
@@ -78,7 +78,7 @@ sudo bash ~/nextwks.sh --destroy
 1. Edit code in your clone.
 2. Bump `VERSION`, update `CHANGELOG.md`.
 3. `git commit -m "message" && git tag v$(cat VERSION) && git push origin main --tags`
-4. On the server: `sudo bash ~/nextwks.sh --update`
+4. On the server: `./nextwks.sh --update`
 
 The script clones fresh from git every time — no stale repos, no permissions issues.
 
diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 1e0b33c..75adc56 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -21,9 +21,17 @@ usage() {
 MODE="${1#--}"
 case "$MODE" in install|update|destroy) ;; *) usage ;; esac
 
-# Helper: run with sudo only for commands that need it
+# MUST NOT run as root — podman must be rootless
+if [ "$(id -u)" -eq 0 ]; then
+    echo "ERROR: Do NOT run this script with sudo or as root."
+    echo "  Run it as your normal user: ./nextwks.sh --$MODE"
+    echo "  The script will prompt for sudo only where needed (apt, /opt/, iptables)."
+    exit 1
+fi
+
+# Helper: run with sudo for operations that need root
 maybe_sudo() {
-    if [ "$(id -u)" -eq 0 ]; then "$@"; else sudo "$@"; fi
+    sudo "$@"
 }
 
 # --- Load existing env (if any), skip if unreadable ---