diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6493ff4f6..0e005811e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -103,6 +103,47 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh` and `install/docker-install.sh` both follow
+this.
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**
 
diff --git a/install/docker-install.sh b/install/docker-install.sh
index 904a65938..dff9eff83 100644
--- a/install/docker-install.sh
+++ b/install/docker-install.sh
@@ -17,11 +17,24 @@ PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
 setup_docker
 
-if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+# Every choice below can be supplied up front so the install runs unattended.
+# Same convention as install/forgejo-runner-install.sh: read the variable, and
+# only ask when it was not set.
+if [[ -z "${var_portainer:-}" ]]; then
+  if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+    var_portainer="yes"
+  else
+    var_portainer="no"
+  fi
+fi
+
+if [[ "${var_portainer:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
   bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
-  read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
-  if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
+  if [[ -z "${var_portainer_agent:-}" ]]; then
+    read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " var_portainer_agent
+  fi
+  if [[ "${var_portainer_agent:-}" =~ ^([yY]|[yY][eE][sS])$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"
     $STD docker run -d \
       -p 9001:9001 \
@@ -34,12 +47,14 @@ else
   fi
 fi
 
-read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-case "${socket_choice,,}" in
-l)
+if [[ -z "${var_docker_socket:-}" ]]; then
+  read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " var_docker_socket
+fi
+case "${var_docker_socket:-}" in
+l | L | local | Local)
   socket="tcp://127.0.0.1:2375"
   ;;
-a)
+a | A | all | All)
   socket="tcp://0.0.0.0:2375"
   ;;
 *)