diff --git a/CloudronManifest.json b/CloudronManifest.json
index e80d860..d607706 100644
--- a/CloudronManifest.json
+++ b/CloudronManifest.json
@@ -7,7 +7,7 @@
   "contactEmail": "contact@ente.io",
   "tagline": "Open Source End-to-End Encrypted Photos & Authentication",
   "upstreamVersion": "1.0.0",
-  "version": "0.1.128",
+  "version": "0.1.133",
   "healthCheckPath": "/ping",
   "httpPort": 3080,
   "memoryLimit": 1073741824,
diff --git a/POSTINSTALL.md b/POSTINSTALL.md
index 1324809..150059f 100644
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -23,8 +23,9 @@ Before you can use Ente, you need to configure an S3-compatible storage service:
 ## Ente CLI
 
 - The Ente CLI binary is pre-built at `/app/code/ente` inside the app container.
-- Open the Cloudron web terminal (working directory `/app/code`) and run commands with `./ente ...` or add `/app/code` to your `PATH`.
-- A writable CLI config template lives at `/app/data/home/.ente/config.yaml` for pointing the CLI to your instance.
+- Open the Cloudron web terminal (working directory `/app/code`) and run commands with `ente ...` or `./ente ...`.
+- The CLI configuration at `/app/data/home/.ente/config.yaml` already points to your instance (`https://<your-domain>/api`).
+- CLI state is stored under `/app/data/cli-data/` so re-logins persist.
 
 ## Museum Server Configuration
 
diff --git a/start.sh b/start.sh
index 0fc545a..22960c6 100644
--- a/start.sh
+++ b/start.sh
@@ -153,14 +153,27 @@ fi
 # Seed Ente CLI configuration directory
 ENTE_CLI_CONFIG_DIR="$HOME/.ente"
 ENTE_CLI_CONFIG_FILE="$ENTE_CLI_CONFIG_DIR/config.yaml"
-if [ ! -f "$ENTE_CLI_CONFIG_FILE" ]; then
-  mkdir -p "$ENTE_CLI_CONFIG_DIR"
+if [ -f "$ENTE_CLI_CONFIG_FILE" ] && grep -q "^# Ente CLI configuration" "$ENTE_CLI_CONFIG_FILE"; then
+  rm -f "$ENTE_CLI_CONFIG_FILE"
+fi
+mkdir -p "$ENTE_CLI_CONFIG_DIR"
+write_cli_config_if_needed() {
   cat > "$ENTE_CLI_CONFIG_FILE" << EOF
-# Ente CLI configuration
-# Uncomment and set the host to point the CLI to this Cloudron deployment.
-#host: https://${CLOUDRON_APP_DOMAIN:-localhost}
+endpoint:
+  api: ${BASE_URL%/}/api
+log:
+  http: false
 EOF
   chown -R cloudron:cloudron "$HOME_DIR" || true
+}
+if [ ! -f "$ENTE_CLI_CONFIG_FILE" ]; then
+  write_cli_config_if_needed
+else
+  if ! grep -q "endpoint:" "$ENTE_CLI_CONFIG_FILE" || grep -q "\\n" "$ENTE_CLI_CONFIG_FILE"; then
+    write_cli_config_if_needed
+  elif ! grep -q "${BASE_URL%/}/api" "$ENTE_CLI_CONFIG_FILE"; then
+    write_cli_config_if_needed
+  fi
 fi
 
 S3_ACCESS_KEY="${S3_ACCESS_KEY:-$DEFAULT_S3_ACCESS_KEY}"