diff --git a/install.sh b/install.sh
index 879210c..2bf9020 100755
--- a/install.sh
+++ b/install.sh
@@ -291,24 +291,40 @@ $SUDO systemctl daemon-reload
 success "Service: $SERVICE_FILE"
 
 # ============================================================
-# AUTHELIA CONFIG
 # ============================================================
-if [ -f "${AUTHELIA_DIR}/authelia" ]; then
-    header "── Authelia Config ──"
-    JWT_SECRET=$(openssl rand -base64 32)
-    SESSION_SECRET=$(openssl rand -base64 32)
-    STORAGE_KEY=$(openssl rand -base64 32)
-    OIDC_HMAC=$(openssl rand -base64 32)
+# AUTHELIA — Download, configure, and start
+# ============================================================
+header "── Authelia ──"
+AUTHELIA_VERSION="4.38.0"
 
-    # Generate RSA key for OIDC signing
-    openssl genrsa -out /tmp/nw-oidc.key 2048 2>/dev/null
-    OIDC_KEY=$(cat /tmp/nw-oidc.key)
-    rm -f /tmp/nw-oidc.key
+if [ ! -f "${AUTHELIA_DIR}/authelia" ]; then
+    info "Downloading Authelia v${AUTHELIA_VERSION}..."
+    $SUDO apt-get update -qq && $SUDO apt-get install -y -qq wget tar openssl jq 2>/dev/null
+    $SUDO mkdir -p "$AUTHELIA_DIR"
+    wget -q "https://github.com/authelia/authelia/releases/download/v${AUTHELIA_VERSION}/authelia-v${AUTHELIA_VERSION}-linux-amd64.tar.gz" -O /tmp/authelia.tar.gz
+    $SUDO tar -xzf /tmp/authelia.tar.gz -C "$AUTHELIA_DIR"
+    $SUDO mv "$AUTHELIA_DIR/authelia-linux-amd64" "$AUTHELIA_DIR/authelia" 2>/dev/null || true
+    $SUDO chmod +x "$AUTHELIA_DIR/authelia"
+    rm -f /tmp/authelia.tar.gz
+    success "Authelia downloaded"
+fi
 
-    # Hash current admin password (if users exist) or generate one
-    ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 12)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder\$placeholder")
+# Generate Authelia secrets and config
+JWT_SECRET=$(openssl rand -base64 32)
+SESSION_SECRET=$(openssl rand -base64 32)
+STORAGE_KEY=$(openssl rand -base64 32)
+OIDC_HMAC=$(openssl rand -base64 32)
 
-    $SUDO tee "$AUTHELIA_CONFIG" > /dev/null << AUTHEOF
+# Generate RSA key for OIDC
+openssl genrsa -out /tmp/nw-oidc.key 2048 2>/dev/null
+OIDC_KEY=$(cat /tmp/nw-oidc.key)
+rm -f /tmp/nw-oidc.key
+
+# Clean old DB if encryption key changed
+$SUDO find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
+
+info "Writing Authelia configuration..."
+$SUDO tee "$AUTHELIA_CONFIG" > /dev/null << AUTHEOF
 theme: light
 server:
   host: 0.0.0.0
@@ -376,16 +392,12 @@ $(echo "$OIDC_KEY" | sed 's/^/          /')
         pre_configured_consent_duration: "1 year"
         userinfo_signed_response_alg: "none"
 AUTHEOF
-    $SUDO chmod 600 "$AUTHELIA_CONFIG"
-    success "Authelia config written"
+$SUDO chmod 600 "$AUTHELIA_CONFIG"
 
-    # Create initial users_database.yml (needed for Authelia to start)
-    if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
-        info "Creating initial users database..."
-        # Remove old DB if encryption key changed
-        find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
-        ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder")
-        cat > "${AUTHELIA_DIR}/users_database.yml" << USERSDB
+# Create initial users database
+if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
+    ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "placeholder")
+    $SUDO tee "${AUTHELIA_DIR}/users_database.yml" > /dev/null << USERSDB
 users:
   placeholder:
     displayname: "Setup Account"
@@ -393,13 +405,39 @@ users:
     email: "${ADMIN_EMAIL:-admin@local}"
     groups: [admins]
 USERSDB
-        $SUDO chmod 600 "${AUTHELIA_DIR}/users_database.yml"
-        success "Users database created"
-    fi
-
-    $SUDO systemctl restart authelia 2>/dev/null && info "Authelia restarted" || info "Authelia not running (will start later)"
+    $SUDO chmod 600 "${AUTHELIA_DIR}/users_database.yml"
 fi
 
+# Create systemd service for Authelia
+$SUDO tee /etc/systemd/system/authelia.service > /dev/null << AUTHSVC
+[Unit]
+Description=Authelia Identity Provider
+After=network.target
+
+[Service]
+Type=simple
+User=${SYS_USER}
+WorkingDirectory=${AUTHELIA_DIR}
+ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_CONFIG}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+AUTHSVC
+
+$SUDO systemctl daemon-reload
+$SUDO systemctl enable authelia 2>/dev/null || true
+$SUDO systemctl restart authelia 2>/dev/null
+sleep 2
+if $SUDO systemctl is-active --quiet authelia 2>/dev/null; then
+    success "Authelia v${AUTHELIA_VERSION} running"
+else
+    warn "Authelia may need manual start — check: sudo journalctl -u authelia"
+fi
+
+# ============================================================
+# SMOKE TEST + ADMIN CREATION
 # ============================================================
 # SMOKE TEST + ADMIN CREATION
 # ============================================================
@@ -458,12 +496,6 @@ $SUDO systemctl enable --now nextwks 2>/dev/null && success "NextWks is running"
 echo ""
 info "  Logs:  sudo journalctl -u nextwks -f"
 echo ""
-if [ -f "${AUTHELIA_DIR}/authelia" ]; then
-    info "  Authelia:   installed and configured"
-else
-    warn "  Authelia:   not installed — run scripts/install-authelia.sh or install manually"
-fi
-echo ""
 if [ -n "${ADMIN_PASS:-}" ]; then
     warn "  ┌─────────────────────────────────────────┐"
     warn "  │  Admin login:  ${AUTH_URL}"