diff --git a/install.sh b/install.sh
index 2bf9020..7dc677b 100755
--- a/install.sh
+++ b/install.sh
@@ -13,17 +13,20 @@ warn()    { echo -e "${YELLOW}$1${NC}"; }
 header()  { echo -e "\n${BOLD}${CYAN}$1${NC}"; }
 
 # ============================================================
-# USER & SUDO
+# SERVICE USER
 # ============================================================
-SYS_USER="${SUDO_USER:-$USER}"
-SYS_HOME=$(eval echo "~$SYS_USER")
-[ "$EUID" -eq 0 ] && SUDO="" || SUDO="sudo"
+SVC_USER="nextwks"
+SYS_HOME="/home/${SVC_USER}"
 
-if [ -z "$SUDO" ] && [ "$EUID" -ne 0 ]; then
-    error "This script needs root for /opt/ and systemd. Use: sudo bash install.sh"
-    exit 1
+# Create service user if needed
+if ! id "$SVC_USER" &>/dev/null; then
+    info "Creating service user: $SVC_USER"
+    useradd -r -s /usr/sbin/nologin -d /nonexistent "$SVC_USER" 2>/dev/null || true
 fi
 
+# Sudo only if not root
+[ "$EUID" -eq 0 ] && SUDO="" || SUDO="sudo"
+
 # ============================================================
 # PATHS
 # ============================================================
@@ -33,7 +36,7 @@ BIN_DIR="${INSTALL_DIR}/bin"
 DATA_DIR="${INSTALL_DIR}/data"
 STATIC_DIR="${INSTALL_DIR}/static"
 CONFIG_FILE="${INSTALL_DIR}/config.yaml"
-ENV_FILE="${SYS_HOME}/.nextwks-env"
+ENV_FILE="${REPO_DIR}/.env"
 AUTHELIA_DIR="/opt/authelia"
 AUTHELIA_CONFIG="${AUTHELIA_DIR}/configuration.yml"
 SERVICE_FILE="/etc/systemd/system/nextwks.service"
@@ -55,15 +58,13 @@ PROXY_IP_DEFAULT="172.16.0.10"
 # ============================================================
 REPO_URL="https://git.lohmar.co.uk/lexton-it/NextWks.git"
 
-# Detect if stdin is piped (curl|bash) — save to file and re-exec
-if [ ! -t 0 ] && [ -z "${NEXTWKS_REEXEC:-}" ]; then
+# If piped from curl (no script file), save and exit
+if [ ! -t 0 ] && [ ! -f "${BASH_SOURCE[0]}" ]; then
     SCRIPT_FILE="/tmp/nextwks-install.sh"
     cat > "$SCRIPT_FILE"
     chmod +x "$SCRIPT_FILE"
-    echo ""
     echo "Script saved to $SCRIPT_FILE"
     echo "Run:  bash $SCRIPT_FILE"
-    echo ""
     exit 0
 fi
 
@@ -76,7 +77,6 @@ if [ ! -f "$REPO_DIR/src/main.go" ]; then
     CLONE_DIR="${SYS_HOME}/nextwks"
     rm -rf "$CLONE_DIR" 2>/dev/null
     git clone --depth 1 "$REPO_URL" "$CLONE_DIR"
-    chown -R "$SYS_USER:$SYS_USER" "$CLONE_DIR" 2>/dev/null || true
     REPO_DIR="$CLONE_DIR"
     success "Cloned to $REPO_DIR"
 fi
@@ -91,13 +91,6 @@ FROM_ENV=false
 # INTERACTIVE WIZARD
 # ============================================================
 gather_inputs() {
-    # Load from .env if --from-env
-    if [ "$FROM_ENV" = true ] && [ -f "$ENV_FILE" ]; then
-        source "$ENV_FILE"
-        success "Loaded configuration from $ENV_FILE"
-        return
-    fi
-
     echo ""
     header "┌─────────────────────────────────────────┐"
     header "│     Next Workspace — Setup Wizard        │"
@@ -171,7 +164,13 @@ ENVEOF
     success "Settings saved to $ENV_FILE"
 }
 
-gather_inputs
+# Load env if --from-env, otherwise run interactive wizard
+if [ "$FROM_ENV" = true ] && [ -f "$ENV_FILE" ]; then
+    source "$ENV_FILE"
+    success "Loaded configuration from $ENV_FILE"
+else
+    gather_inputs
+fi
 
 # Derive domains from URLs (needed even when --from-env)
 NEXTWKS_DOMAIN=$(echo "$NEXTWKS_URL" | sed 's|https\?://||;s|/.*||')
@@ -211,7 +210,7 @@ header "── Installing ──"
 $SUDO mkdir -p "$BIN_DIR" "$DATA_DIR" "$STATIC_DIR"
 $SUDO cp "$REPO_DIR/app/core" "$BIN_DIR/core"
 $SUDO chmod 755 "$BIN_DIR/core"
-$SUDO chown -R "$SYS_USER:$SYS_USER" "$DATA_DIR" 2>/dev/null || true
+$SUDO chown -R "$SVC_USER:$SVC_USER" "$DATA_DIR" 2>/dev/null || true
 [ -d "$REPO_DIR/app/static" ] && $SUDO cp -r "$REPO_DIR/app/static"/* "$STATIC_DIR/"
 success "Copied files to $INSTALL_DIR/"
 
@@ -253,8 +252,8 @@ session:
   expiry_minutes: 60
 CONFIGEOF
 $SUDO chmod 600 "$CONFIG_FILE"
-$SUDO chown "$SYS_USER:$SYS_USER" "$CONFIG_FILE"
-$SUDO chown -R "$SYS_USER:$SYS_USER" "$DATA_DIR"
+$SUDO chown "$SVC_USER:$SVC_USER" "$CONFIG_FILE"
+$SUDO chown -R "$SVC_USER:$SVC_USER" "$DATA_DIR"
 success "Config: $CONFIG_FILE"
 
 # ============================================================
@@ -269,7 +268,7 @@ Wants=authelia.service
 
 [Service]
 Type=simple
-User=${SYS_USER}
+User=${SVC_USER}
 WorkingDirectory=${INSTALL_DIR}
 ExecStart=${BIN_DIR}/core -config ${CONFIG_FILE}
 Restart=always
@@ -393,6 +392,9 @@ $(echo "$OIDC_KEY" | sed 's/^/          /')
         userinfo_signed_response_alg: "none"
 AUTHEOF
 $SUDO chmod 600 "$AUTHELIA_CONFIG"
+$SUDO chown "$SVC_USER:$SVC_USER" "$AUTHELIA_CONFIG" "${AUTHELIA_DIR}/users_database.yml" "${AUTHELIA_DIR}/db.sqlite3" 2>/dev/null || true
+# Clean up files from Authelia tar
+$SUDO rm -f "${AUTHELIA_DIR}/authelia.service" "${AUTHELIA_DIR}/config.template.yml" 2>/dev/null || true
 
 # Create initial users database
 if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
@@ -416,7 +418,7 @@ After=network.target
 
 [Service]
 Type=simple
-User=${SYS_USER}
+User=${SVC_USER}
 WorkingDirectory=${AUTHELIA_DIR}
 ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_CONFIG}
 Restart=always