diff --git a/.env.example b/.env.example
index a05deb4..a121e0c 100644
--- a/.env.example
+++ b/.env.example
@@ -12,8 +12,10 @@ MEDIAPI_PASSWORD=changeme
 MEDIAPI_MEDIA_ROOTS=/localmedia
 MEDIAPI_PORT=8080
 
-# --- System: systemd services run as this Linux user ---
-MEDIAPI_USER=pi
+# --- System: the Linux user the systemd services run as ---
+# Auto-detected from whoever runs install.sh (id -un) when left unset, so you
+# normally don't need this. Uncomment only to force a specific user.
+#MEDIAPI_USER=pi
 
 # --- WiFi access point (re-applied by install.sh) ---
 MEDIAPI_WIFI_COUNTRY=US
diff --git a/README.md b/README.md
index 89670fd..6deb415 100644
--- a/README.md
+++ b/README.md
@@ -134,19 +134,16 @@ screen (`--hwdec=auto-safe` falls back to software if the HW decoder is busy).
 sudo apt update
 sudo apt install -y mpv
 
-# mpv needs access to the GPU/DRM devices to render to HDMI
-# (use the MEDIAPI_USER from your .env)
-sudo usermod -aG video,render "$USER"
-# log out/in (or reboot) for the new group membership to take effect
-
 # install uv (Python package/venv manager) if not already present
 curl -LsSf https://astral.sh/uv/install.sh | sh   # installs to ~/.local/bin/uv
 
 # create your .env (see Configuration above)
 cp .env.example .env && $EDITOR .env
 
-# deploy the currently-checked-out ref: syncs deps, configures the AP,
-# installs+starts the services
+# deploy the currently-checked-out ref: syncs deps, adds the service user to
+# the video+render groups (GPU/DRM access for HDMI), configures the AP,
+# installs+starts the services. Run as your normal user -- NOT with sudo, or
+# the services get rendered to run as root.
 ./install.sh
 
 # verify
diff --git a/install.sh b/install.sh
index 8495152..9fe1b49 100755
--- a/install.sh
+++ b/install.sh
@@ -116,6 +116,14 @@ deploy_current() {
     chmod 600 instance/secret_key
   fi
 
+  # The mpv service runs as MEDIAPI_USER and needs the video+render groups to
+  # reach the GPU/DRM devices for HDMI output. Idempotent; systemd picks up the
+  # new membership when it (re)starts the service below, so no logout needed.
+  if ! id -nG "${MEDIAPI_USER}" | tr ' ' '\n' | grep -qx render; then
+    echo "==> Adding '${MEDIAPI_USER}' to video,render groups ..."
+    sudo usermod -aG video,render "${MEDIAPI_USER}"
+  fi
+
   echo "==> Applying WiFi country + AP config ..."
   sudo raspi-config nonint do_wifi_country "${MEDIAPI_WIFI_COUNTRY}"
   if nmcli -g NAME con show | grep -qx "${MEDIAPI_AP_CONN_NAME}"; then