diff --git a/install/npmplus-install.sh b/install/npmplus-install.sh
index 546e8cc88..1d709e107 100644
--- a/install/npmplus-install.sh
+++ b/install/npmplus-install.sh
@@ -90,6 +90,7 @@ customize
 msg_info "Retrieving Default Login (Patience)"
 PASSWORD_FOUND=0
 
+# Try to find password in existing logs (max 120 seconds)
 for i in {1..60}; do
   PASSWORD_LINE=$(
     { awk '/Creating a new user:/{print; exit}' < <(docker logs "$CONTAINER_ID" 2>&1); } || true
@@ -104,21 +105,24 @@ for i in {1..60}; do
   fi
   sleep 2
 done
+
+# If not found, try live log stream (30s)
 if [[ $PASSWORD_FOUND -eq 0 ]]; then
   PASSWORD_LINE=$(
     timeout 30s bash -c '
       docker logs -f --since=0s --tail=0 "$1" 2>&1 | awk "/Creating a new user:/{print; exit}"
-    ' _ "$CONTAINER_ID" || true
+    ' _ "$CONTAINER_ID" 2>/dev/null || true
   )
   if [[ -n "${PASSWORD_LINE:-}" ]]; then
     PASSWORD="${PASSWORD_LINE#*password: }"
     printf 'username: admin@example.org\npassword: %s\n' "$PASSWORD" >/opt/.npm_pwd
-    msg_ok "Saved default login to /opt/.npm_pwd (live)"
+    msg_ok "Saved default login to /opt/.npm_pwd"
     PASSWORD_FOUND=1
   fi
 fi
 
 if [[ $PASSWORD_FOUND -eq 0 ]]; then
-  msg_error "Could not retrieve default login after 120s."
-  echo -e "\nYou can manually check the container logs with:\n  docker logs $CONTAINER_ID | grep 'Creating a new user:'\n"
+  msg_warn "Default login not found in logs (this is normal for NPMplus)"
+  msg_custom "💡" "${GN}" "NPMplus creates an admin account on first web access"
+  msg_custom "📋" "${GN}" "Visit http://<IP>:81 and create your admin user"
 fi