diff --git a/POSTINSTALL.md b/POSTINSTALL.md
index 9420ae0..1abde2d 100644
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -60,39 +60,25 @@ The installer now asks for dedicated hostnames for the Auth/Accounts/Cast/Albums
 
 ## Administration
 
-- Use the bundled CLI from the Cloudron web terminal (CLI state lives in `/app/data/cli-data`). On a new deployment initialise it once (this seeds the CLI config, whitelists an admin email, and resets the CLI DB):
+- **Grant yourself admin privileges**
+  1. Open the Cloudron dashboard → your Ente app → **File Manager**.
+  2. Navigate to `/app/data/config/` and open (or create) `museum.override.yaml`.
+  3. Add your email to the super-admin list:
+     ```yaml
+     internal:
+       super-admins:
+         - you@example.com
+     ```
+  4. Save the file and restart the app. The override is appended to Museum’s configuration on every start.
+
+- **Sign in to the bundled CLI**
+  *The package now preconfigures the CLI (config: `/app/data/cli-data/config.yaml`, exports: `/app/data/cli-data/export`).*  
+  From the Cloudron **Terminal** run:
   ```bash
-  # from the Cloudron terminal, logged in as root
-  cat <<'EOF' >/cli-data/config.yaml
-endpoint:
-  api: https://<your-app-domain>/api
-log:
-  http: false
-EOF
-  mkdir -p /cli-data/export
-  chown cloudron:cloudron /cli-data /cli-data/config.yaml /cli-data/export
-  cat <<'EOF' >/app/data/config/museum.override.yaml
-internal:
-  super-admins:
-    - admin@example.com
-EOF
-  rm -f /cli-data/ente-cli.db
-  chown cloudron:cloudron /app/data/config/museum.override.yaml
-
-  cloudron restart --app <your-app-domain>
-
-  # store your account (enter the OTP emailed to you)
+  # authenticate once (enter the OTP you receive by email)
   sudo -u cloudron ente account add
 
   # inspect available commands
   sudo -u cloudron ente --help
   ```
-  Once the account is added you can follow the upstream admin docs for tasks like whitelisting and quota adjustments.
-  See the upstream admin guides for further context: [user administration](https://ente.io/help/self-hosting/administration/users) and [CLI reference](https://ente.io/help/self-hosting/administration/cli).
-
-- To persist custom Museum settings (for example, seeding super-admin email addresses), create `/app/data/config/museum.override.yaml`. The file is appended to `museum/configurations/local.yaml` on each startup.
-  ```yaml
-  internal:
-    super-admins:
-      - admin@example.com
-  ```
+  After you’re signed in you can follow the upstream docs for tasks like increasing storage: see [user administration](https://ente.io/help/self-hosting/administration/users) and the [CLI reference](https://ente.io/help/self-hosting/administration/cli).
diff --git a/start.sh b/start.sh
index 491a9dd..b7a0a0d 100755
--- a/start.sh
+++ b/start.sh
@@ -602,16 +602,32 @@ CLI_DATA_DIR="$DATA_DIR/cli-data"
 mkdir -p "$CLI_DATA_DIR"
 chown cloudron:cloudron "$CLI_DATA_DIR"
 chmod 700 "$CLI_DATA_DIR"
+CLI_EXPORT_DIR="$CLI_DATA_DIR/export"
+if [ ! -d "$CLI_EXPORT_DIR" ]; then
+  mkdir -p "$CLI_EXPORT_DIR"
+  chown cloudron:cloudron "$CLI_EXPORT_DIR"
+  chmod 700 "$CLI_EXPORT_DIR"
+fi
 
-CLI_HOME="$DATA_DIR/home/.ente"
-mkdir -p "$CLI_HOME"
-cat > "$CLI_HOME/config.yaml" <<EOF_CLI
+CLI_DATA_CONFIG="$CLI_DATA_DIR/config.yaml"
+if [ ! -f "$CLI_DATA_CONFIG" ]; then
+  cat > "$CLI_DATA_CONFIG" <<EOF_CLI_DATA
 endpoint:
   api: ${API_ORIGIN}
 log:
   http: false
-EOF_CLI
-chown -R cloudron:cloudron "$DATA_DIR/home"
+EOF_CLI_DATA
+  chown cloudron:cloudron "$CLI_DATA_CONFIG"
+  chmod 600 "$CLI_DATA_CONFIG"
+  log INFO "Initialised CLI data configuration at $CLI_DATA_CONFIG"
+fi
+
+CLI_HOME="$DATA_DIR/home/.ente"
+mkdir -p "$CLI_HOME"
+if [ ! -f "$CLI_HOME/config.yaml" ]; then
+  ln -sf "$CLI_DATA_CONFIG" "$CLI_HOME/config.yaml"
+fi
+chown -R cloudron:cloudron "$DATA_DIR/home" "$CLI_HOME"
 chmod 700 "$DATA_DIR/home"
 
 log INFO "Rendering Caddy configuration"