diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0e005811e..e76692cf3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -118,8 +118,16 @@ var_admin_user="${var_admin_user:-admin}"
 ```
 
 Name them `var_<something>`, the same namespace the container variables use.
-`install/forgejo-runner-install.sh` and `install/docker-install.sh` both follow
-this.
+`install/forgejo-runner-install.sh` and `install/pangolin-install.sh` both
+follow this.
+
+The variable also has to be exported from `ct/<app>.sh`, or it never reaches
+the container — `lxc-attach` carries the caller's environment, but only for
+what was actually exported:
+
+```bash
+export var_admin_user="${var_admin_user:-}"
+```
 
 Declare them on the script's PocketBase record in `app_vars` so the website's
 generator can offer them as fields:
diff --git a/ct/forgejo-runner.sh b/ct/forgejo-runner.sh
index 7c7c1774f..1184c22db 100644
--- a/ct/forgejo-runner.sh
+++ b/ct/forgejo-runner.sh
@@ -18,6 +18,7 @@ var_nesting="${var_nesting:-1}"
 var_keyctl="${var_keyctl:-1}"
 
 export var_forgejo_instance="${var_forgejo_instance:-}"
+export var_forgejo_runner_uuid="${var_forgejo_runner_uuid:-}"
 export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
 export var_runner_labels="${var_runner_labels:-}"
 
@@ -64,6 +65,10 @@ if [[ -n "${mode:-}" ]]; then
     msg_error "var_forgejo_instance is required for unattended installs."
     exit 1
   fi
+  if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+    msg_error "var_forgejo_runner_uuid is required for unattended installs."
+    exit 1
+  fi
   if [[ -z "${var_forgejo_runner_token:-}" ]]; then
     msg_error "var_forgejo_runner_token is required for unattended installs."
     exit 1
diff --git a/ct/pangolin.sh b/ct/pangolin.sh
index 542c9c510..b69584e52 100644
--- a/ct/pangolin.sh
+++ b/ct/pangolin.sh
@@ -17,6 +17,9 @@ var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"
 
+export var_pangolin_url="${var_pangolin_url:-}"
+export var_pangolin_email="${var_pangolin_email:-}"
+
 header_info "$APP"
 variables
 color
diff --git a/install/docker-install.sh b/install/docker-install.sh
index dff9eff83..904a65938 100644
--- a/install/docker-install.sh
+++ b/install/docker-install.sh
@@ -17,24 +17,11 @@ PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
 setup_docker
 
-# Every choice below can be supplied up front so the install runs unattended.
-# Same convention as install/forgejo-runner-install.sh: read the variable, and
-# only ask when it was not set.
-if [[ -z "${var_portainer:-}" ]]; then
-  if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
-    var_portainer="yes"
-  else
-    var_portainer="no"
-  fi
-fi
-
-if [[ "${var_portainer:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
+if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
   bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
-  if [[ -z "${var_portainer_agent:-}" ]]; then
-    read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " var_portainer_agent
-  fi
-  if [[ "${var_portainer_agent:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
+  read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
+  if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"
     $STD docker run -d \
       -p 9001:9001 \
@@ -47,14 +34,12 @@ else
   fi
 fi
 
-if [[ -z "${var_docker_socket:-}" ]]; then
-  read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " var_docker_socket
-fi
-case "${var_docker_socket:-}" in
-l | L | local | Local)
+read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
+case "${socket_choice,,}" in
+l)
   socket="tcp://127.0.0.1:2375"
   ;;
-a | A | all | All)
+a)
   socket="tcp://0.0.0.0:2375"
   ;;
 *)
diff --git a/install/pangolin-install.sh b/install/pangolin-install.sh
index 50b662851..ae8582f2a 100644
--- a/install/pangolin-install.sh
+++ b/install/pangolin-install.sh
@@ -27,9 +27,18 @@ fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VER
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 
-read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+# Read the variable first and prompt only when it is unset, so the install can
+# be supplied up front. Same convention as install/forgejo-runner-install.sh.
+pango_url="${var_pangolin_url:-}"
+if [[ -z "$pango_url" ]]; then
+  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+fi
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
-read -rp "${TAB3}Enter your email address: " pango_email
+
+pango_email="${var_pangolin_email:-}"
+if [[ -z "$pango_email" ]]; then
+  read -rp "${TAB3}Enter your email address: " pango_email
+fi
 
 msg_info "Setup Pangolin"
 SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)