diff --git a/setup.sh b/setup.sh
index f24c0ee..f1e021d 100644
--- a/setup.sh
+++ b/setup.sh
@@ -3,6 +3,7 @@ set -euo pipefail
 
 # Server setup script for a fresh Rocky Linux 9 (or compatible) install.
 # Run as root after cloning the repo to /opt/hantim.
+# Safe to re-run — all steps are idempotent.
 #
 # Usage:
 #   1. dnf install -y git
@@ -30,34 +31,45 @@ fi
 echo "==> Installing dependencies..."
 dnf install -y git-crypt npm
 
-echo "==> Installing Bitwarden CLI..."
-npm install -g @bitwarden/cli
+if ! command -v bw &>/dev/null; then
+    echo "==> Installing Bitwarden CLI..."
+    npm install -g @bitwarden/cli
+fi
 
 # --- Unlock git-crypt via Bitwarden ---
 
-echo "==> Fetching git-crypt key from Bitwarden..."
-echo "    Log in to Bitwarden when prompted."
-bw login
-BW_SESSION=$(bw unlock --raw)
-bw get notes hantim-git-crypt-key --session "$BW_SESSION" | base64 -d > /tmp/git-crypt-key
-
 cd "$REPO_DIR"
-git-crypt unlock /tmp/git-crypt-key
-rm /tmp/git-crypt-key
-bw lock
+if git-crypt status 2>/dev/null | grep -q '^\*\*\*ENCRYPTED\*\*\*'; then
+    echo "==> Fetching git-crypt key from Bitwarden..."
+    echo "    Log in to Bitwarden when prompted."
+    if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
+        bw login
+    fi
+    BW_SESSION=$(bw unlock --raw)
+    bw get notes hantim-git-crypt-key --session "$BW_SESSION" | base64 -d > /tmp/git-crypt-key
+    git-crypt unlock /tmp/git-crypt-key
+    rm /tmp/git-crypt-key
+    bw lock
+else
+    echo "==> git-crypt already unlocked, skipping."
+fi
 
 # --- Install Docker ---
 
-echo "==> Installing Docker..."
-dnf install -y dnf-plugins-core
-dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
-dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+if ! command -v docker &>/dev/null; then
+    echo "==> Installing Docker..."
+    dnf install -y dnf-plugins-core
+    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
+    dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+fi
 systemctl enable --now docker
 
 # --- Create deploy user ---
 
-echo "==> Creating deploy user..."
-useradd -r -s /usr/sbin/nologin deploy
+if ! id deploy &>/dev/null; then
+    echo "==> Creating deploy user..."
+    useradd -r -s /usr/sbin/nologin deploy
+fi
 usermod -aG docker deploy
 
 echo "==> Setting up deploy SSH key..."
@@ -76,7 +88,7 @@ echo "==> Making scripts executable..."
 chmod +x "$REPO_DIR/scripts/"*.sh
 
 echo "==> Creating shared Docker network..."
-docker network create shared || true
+docker network create shared 2>/dev/null || true
 
 echo "==> Logging into Gitea registry..."
 echo "Run manually: docker login git.timothykim.net"