diff --git a/README.md b/README.md
index fbc2729..d339a84 100644
--- a/README.md
+++ b/README.md
@@ -24,16 +24,22 @@ setup.sh             # One-time server provisioning script
 On a fresh Rocky Linux 9 (or compatible) install:
 
 ```bash
-dnf install -y epel-release
-dnf install -y git git-crypt
-git clone <repo-url> /opt/hantim
-git-crypt unlock /path/to/git-crypt-key
+dnf install -y git
+git clone https://git.timothykim.net/timothykim/hantim-server.git /opt/hantim
 /opt/hantim/setup.sh
 ```
 
-`setup.sh` installs Docker, creates a `deploy` user, sets up the shared Docker
-network, and starts all services. See the script for the full list of post-setup
-steps (registry login, Nginx Proxy Manager config, etc.).
+`setup.sh` handles everything else: installs git-crypt and the Bitwarden CLI,
+fetches the git-crypt key from your Bitwarden vault (stored as a base64-encoded
+secure note named `hantim-git-crypt-key`), unlocks the repo, installs Docker,
+creates the `deploy` user, and starts all services.
+
+To save the git-crypt key to Bitwarden (one-time, from your dev machine):
+
+```bash
+base64 /path/to/git-crypt-key
+# Save the output as a Bitwarden secure note named "hantim-git-crypt-key"
+```
 
 ## How deploys work
 
diff --git a/setup.sh b/setup.sh
index 3814bed..9de0dd8 100644
--- a/setup.sh
+++ b/setup.sh
@@ -5,56 +5,57 @@ set -euo pipefail
 # Run as root after cloning the repo to /opt/hantim.
 #
 # Usage:
-#   1. dnf install -y epel-release && dnf install -y git git-crypt
-#   2. git clone <repo-url> /opt/hantim
-#   3. git-crypt unlock /path/to/git-crypt-key
-#   4. /opt/hantim/setup.sh
+#   1. dnf install -y git
+#   2. git clone https://git.timothykim.net/timothykim/hantim-server.git /opt/hantim
+#   3. /opt/hantim/setup.sh
 #
 
-errors=()
+REPO_DIR="/opt/hantim"
+
+# --- Prerequisites ---
 
 if [ "$(id -u)" -ne 0 ]; then
-    errors+=("Not running as root. Please run this script as root.")
-fi
-
-if ! command -v git &>/dev/null; then
-    errors+=("git is not installed. Run: dnf install -y epel-release && dnf install -y git git-crypt")
-fi
-
-if ! command -v git-crypt &>/dev/null; then
-    errors+=("git-crypt is not installed. Run: dnf install -y epel-release && dnf install -y git git-crypt")
-fi
-
-if [ "$(pwd)" != "/opt/hantim" ] && [ "$(dirname "$(readlink -f "$0")")" != "/opt/hantim" ]; then
-    errors+=("Repo does not appear to be cloned to /opt/hantim. Run: git clone <repo-url> /opt/hantim")
-fi
-
-if git-crypt status &>/dev/null && git-crypt status 2>/dev/null | grep -q '^\*\*\*ENCRYPTED\*\*\*'; then
-    errors+=("git-crypt has not been unlocked. Run: git-crypt unlock /path/to/git-crypt-key")
-fi
-
-if [ ${#errors[@]} -gt 0 ]; then
-    echo "ERROR: Prerequisites not met."
-    echo ""
-    echo "Please complete the initial setup before running this script:"
-    echo "  1. dnf install -y epel-release && dnf install -y git git-crypt"
-    echo "  2. git clone <repo-url> /opt/hantim"
-    echo "  3. git-crypt unlock /path/to/git-crypt-key"
-    echo "  4. /opt/hantim/setup.sh"
-    echo ""
-    echo "Issues found:"
-    for err in "${errors[@]}"; do
-        echo "  - $err"
-    done
+    echo "ERROR: Not running as root."
     exit 1
 fi
 
+if [ "$(dirname "$(readlink -f "$0")")" != "$REPO_DIR" ]; then
+    echo "ERROR: Repo does not appear to be cloned to $REPO_DIR."
+    echo "  git clone https://git.timothykim.net/timothykim/hantim-server.git $REPO_DIR"
+    exit 1
+fi
+
+# --- Install dependencies ---
+
+echo "==> Installing dependencies..."
+dnf install -y git-crypt npm
+
+echo "==> Installing Bitwarden CLI..."
+npm install -g @bitwarden/cli
+
+# --- Unlock git-crypt via Bitwarden ---
+
+echo "==> Fetching git-crypt key from Bitwarden..."
+echo "    Log in to Bitwarden when prompted."
+bw login
+BW_SESSION=$(bw unlock --raw)
+bw get notes hantim-git-crypt-key --session "$BW_SESSION" | base64 -d > /tmp/git-crypt-key
+
+cd "$REPO_DIR"
+git-crypt unlock /tmp/git-crypt-key
+rm /tmp/git-crypt-key
+bw lock
+
+# --- Install Docker ---
+
 echo "==> Installing Docker..."
 dnf install -y dnf-plugins-core
 dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
 dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
 systemctl enable --now docker
 
+# --- Create deploy user ---
+
 echo "==> Creating deploy user..."
 useradd -r -s /usr/sbin/nologin deploy
 usermod -aG docker deploy
@@ -69,8 +70,10 @@ if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
 fi
 chown -R deploy:deploy /home/deploy/.ssh
 
+# --- Start services ---
+
 echo "==> Making scripts executable..."
-chmod +x /opt/hantim/scripts/*.sh
+chmod +x "$REPO_DIR/scripts/"*.sh
 
 echo "==> Creating shared Docker network..."
 docker network create shared || true
@@ -79,12 +82,11 @@ echo "==> Logging into Gitea registry..."
 echo "Run manually: docker login git.timothykim.net"
 
 echo "==> Starting services..."
-cd /opt/hantim/docker/nginx && docker compose up -d
-cd /opt/hantim/docker/timothykim.net && docker compose up -d
+cd "$REPO_DIR/docker/nginx" && docker compose up -d
+cd "$REPO_DIR/docker/timothykim.net" && docker compose up -d
 
 echo "==> Done. Don't forget to:"
 echo "  1. Add the deploy SSH public key to /home/deploy/.ssh/authorized_keys"
 echo "  2. Log into the Gitea Docker registry: docker login git.timothykim.net"
 echo "  3. Configure Nginx Proxy Manager at http://<server-ip>:81"
 echo "  4. Restore NPM data/certs backup if migrating"
-