diff --git a/setup.sh b/setup.sh
index d04e092..f55857c 100755
--- a/setup.sh
+++ b/setup.sh
@@ -103,6 +103,14 @@ if [[ ${EUID} -eq 0 ]]; then
     exit 1
 fi
 
+# Ask for the sudo password ONCE, up front, on a clean screen. Otherwise the
+# first sudo call mid-run prints its prompt straight into the live progress
+# line ("Installing (optional): gum[sudo] password for yuri:" — VM-proven).
+# The timestamp refreshes on every subsequent sudo use, so one prompt covers
+# the whole run.
+info "Requesting sudo credentials (asked once for the whole run)..."
+sudo -v
+
 if [[ "$ASSUME_YES" == "true" && ( -z "$DE" || -z "$TWM" ) ]]; then
     err "--yes requires explicit --de and --twm, so nothing is guessed on an"
     err "unattended run. Example:"