diff --git a/setup.sh b/setup.sh
index 0259df6..50a0fff 100755
--- a/setup.sh
+++ b/setup.sh
@@ -51,10 +51,16 @@ ok "pnpm $(pnpm --version)"
 command -v python3 >/dev/null 2>&1 \
     || die "python3 not found — required to generate JWT tokens."
 
+# just may be installed in non-standard locations (Cargo, Homebrew, ~/.local/bin).
+# Extend PATH before checking so we don't reinstall needlessly.
+export PATH="$PATH:$HOME/.cargo/bin:$HOME/.local/bin:/home/linuxbrew/.linuxbrew/bin"
+
 if ! command -v just >/dev/null 2>&1; then
-    warn "just not found — installing to /usr/local/bin (requires sudo)"
+    warn "just not found — installing to ~/.local/bin (no sudo needed)"
+    mkdir -p "$HOME/.local/bin"
     curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \
-        | sudo bash -s -- --to /usr/local/bin
+        | bash -s -- --to "$HOME/.local/bin"
+    export PATH="$PATH:$HOME/.local/bin"
     ok "just $(just --version)"
 else
     ok "just $(just --version)"
@@ -67,8 +73,17 @@ if grep -qE '^\s*127\.0\.0\.1\s+.*\bkeycloak\b' /etc/hosts 2>/dev/null; then
     ok "Entry already present"
 else
     warn "Adding '127.0.0.1 keycloak' to /etc/hosts (requires sudo)"
-    echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts >/dev/null
-    ok "Entry added"
+    if echo "127.0.0.1 keycloak" | sudo -n tee -a /etc/hosts >/dev/null 2>&1; then
+        ok "Entry added"
+    else
+        # sudo requires a password — ask the user to do it once manually
+        echo
+        echo -e "  ${YELLOW}Run this command manually, then re-run setup.sh:${NC}"
+        echo
+        echo "    echo '127.0.0.1 keycloak' | sudo tee -a /etc/hosts"
+        echo
+        die "/etc/hosts entry missing and sudo requires a password. Add it manually (see above) and re-run."
+    fi
 fi
 
 # ── 3. .env ────────────────────────────────────────────────────────────────────
@@ -142,8 +157,16 @@ mkdir -p supabase/migrations
 
 if [[ ! -w supabase/migrations ]]; then
     warn "supabase/migrations not writable — fixing with sudo chown"
-    sudo chown "$USER:$USER" supabase/migrations
-    ok "Permissions fixed"
+    if sudo -n chown "$USER:$USER" supabase/migrations 2>/dev/null; then
+        ok "Permissions fixed"
+    else
+        echo
+        echo -e "  ${YELLOW}Run this command manually, then re-run setup.sh:${NC}"
+        echo
+        echo "    sudo chown \$USER:\$USER supabase/migrations"
+        echo
+        die "supabase/migrations is not writable. Fix it manually (see above) and re-run."
+    fi
 else
     ok "supabase/migrations is writable"
 fi