diff --git a/artifacts/api-server/src/lib/setupService.ts b/artifacts/api-server/src/lib/setupService.ts
index 57679e08..71a990a4 100644
--- a/artifacts/api-server/src/lib/setupService.ts
+++ b/artifacts/api-server/src/lib/setupService.ts
@@ -357,5 +357,25 @@ export async function isSetupOpen(): Promise<boolean> {
   }
 }
 
+// Companion to isSetupOpen() that returns the full SetupStatus payload
+// alongside the redirect decision so the SPA router (and any other
+// caller making a redirect choice) gets a single, authoritative answer
+// without making two requests. `shouldRedirect` is true iff the wizard
+// should be shown — i.e. setup is open AND the DB check succeeded.
+export async function redirectIfSetupNeeded(): Promise<{
+  shouldRedirect: boolean;
+  target: "/setup" | null;
+  status: SetupStatus;
+}> {
+  const status = await readStatus();
+  const shouldRedirect =
+    status.checks.db === "ok" && !status.installed && status.setupRequired;
+  return {
+    shouldRedirect,
+    target: shouldRedirect ? "/setup" : null,
+    status,
+  };
+}
+
 // Exported for use by tests; unused at runtime.
 export const _internal = { adminExists, getSystemSettings, readAppVersion };
diff --git a/docker-compose.yml b/docker-compose.yml
index 472a01c9..25322d08 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -97,11 +97,25 @@ services:
       LOCAL_DOMAIN: ${LOCAL_DOMAIN:-tx.local}
       LOCAL_IP: ${LOCAL_IP:-127.0.0.1}
       HTTPS_MODE: ${HTTPS_MODE:-local}
+    # Pick the Caddyfile at boot. In skip mode we use a cert-free,
+    # HTTP-only config so Caddy can start without /certs being
+    # populated. start.sh forces APP_PORT-compatible HTTP_PORT in
+    # this mode so http://localhost:${APP_PORT} keeps working.
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        if [ "$${HTTPS_MODE}" = "skip" ]; then
+          exec caddy run --config /etc/caddy/Caddyfile.skip --adapter caddyfile
+        else
+          exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
+        fi
     ports:
-      - "${HTTP_PORT:-80}:80"
+      - "${HTTP_PORT:-${APP_PORT:-80}}:80"
       - "${HTTPS_PORT:-443}:443"
     volumes:
       - ./docker/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./docker/Caddyfile.skip:/etc/caddy/Caddyfile.skip:ro
       - ./certs:/certs:ro
       - caddy_data:/data
       - caddy_config:/config
diff --git a/docker/Caddyfile.skip b/docker/Caddyfile.skip
new file mode 100644
index 00000000..a1749eb9
--- /dev/null
+++ b/docker/Caddyfile.skip
@@ -0,0 +1,30 @@
+# Tx OS — Caddy reverse proxy in HTTPS_MODE=skip (developer-only).
+#
+# Serves plaintext HTTP on :80 with NO certificate requirement. Used
+# by start.sh on hosts that don't have mkcert / a real cert yet so
+# the operator can still reach the app and run the first-time wizard.
+# Never enable this in production.
+
+{
+	auto_https disable_certs
+	admin off
+}
+
+(api_proxy) {
+	@websocket {
+		header Connection *Upgrade*
+		header Upgrade websocket
+	}
+	reverse_proxy /api/socket.io/* api:8080
+	reverse_proxy /api/* api:8080
+}
+
+(spa_proxy) {
+	reverse_proxy web:80
+}
+
+:80 {
+	encode zstd gzip
+	import api_proxy
+	import spa_proxy
+}
diff --git a/start.sh b/start.sh
index 970a24bf..2ae158dc 100755
--- a/start.sh
+++ b/start.sh
@@ -64,11 +64,41 @@ case "$action" in
   up)
     echo "==> Building images (first time can take 5-10 minutes) ..."
     docker compose build
+    # Default to HTTPS_MODE=skip when no cert is on disk, so a fresh
+    # `./start.sh` keeps working on hosts that don't have mkcert. The
+    # operator can switch to local/byo later via `local-setup.sh`.
+    if ! grep -qE '^HTTPS_MODE=' .env; then
+      if [ -f certs/local-cert.pem ] && [ -f certs/local-key.pem ]; then
+        echo "HTTPS_MODE=local" >> .env
+      else
+        echo "HTTPS_MODE=skip" >> .env
+      fi
+    fi
+    HTTPS_MODE="$(grep -E '^HTTPS_MODE=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
+    APP_PORT="$(grep -E '^APP_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
+    APP_PORT="${APP_PORT:-3000}"
+    # In skip mode, expose Caddy on APP_PORT so the legacy URL still
+    # works. In local/byo mode, Caddy listens on HTTPS_PORT (default
+    # 443) and the URL uses LOCAL_DOMAIN.
+    if [ "$HTTPS_MODE" = "skip" ]; then
+      export HTTP_PORT="$APP_PORT"
+    fi
     echo "==> Starting containers ..."
-    docker compose up -d
-    APP_PORT="$(grep -E '^APP_PORT=' .env | cut -d= -f2 | tr -d '\r' || echo 3000)"
+    HTTP_PORT="${HTTP_PORT:-${APP_PORT}}" docker compose up -d
     echo
-    echo "Tx OS is starting. Open http://localhost:${APP_PORT:-3000}"
+    if [ "$HTTPS_MODE" = "skip" ]; then
+      echo "Tx OS is starting. Open http://localhost:${APP_PORT}"
+    else
+      LOCAL_DOMAIN="$(grep -E '^LOCAL_DOMAIN=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
+      HTTPS_PORT="$(grep -E '^HTTPS_PORT=' .env | head -n1 | cut -d= -f2 | tr -d '\r')"
+      LOCAL_DOMAIN="${LOCAL_DOMAIN:-tx.local}"
+      HTTPS_PORT="${HTTPS_PORT:-443}"
+      if [ "$HTTPS_PORT" = "443" ]; then
+        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}"
+      else
+        echo "Tx OS is starting. Open https://${LOCAL_DOMAIN}:${HTTPS_PORT}"
+      fi
+    fi
     echo "Tail logs with:  ./start.sh logs"
     ;;
   rebuild)