diff --git a/lib/common.sh b/lib/common.sh
index cac492a..5b22c1d 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -92,6 +92,17 @@ pkg_installed() {
     return 0
 }
 
+# True if ANY of the listed packages is installed (pkg_installed is AND).
+pkg_installed_any() {
+    local p
+    for p in "$@"; do
+        if rpm -q "$p" &>/dev/null; then
+            return 0
+        fi
+    done
+    return 1
+}
+
 remove_packages() {
     local packages_to_remove=()
     for pkg in "$@"; do
diff --git a/lib/session.sh b/lib/session.sh
index 32fe710..3ad6ebe 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -134,7 +134,7 @@ UNIT
     # requires libvirt-glib client-side, so on a fresh VM libvirt can be
     # functionally present via libvirt-daemon* without rpm -q libvirt passing
     # (VM-proven: user stuck in yuri+wheel with virt-manager installed).
-    if pkg_installed libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
+    if pkg_installed_any libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
         || [[ -x /usr/sbin/libvirtd ]]; then
         local real_user="${SUDO_USER:-$USER}"
         if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
diff --git a/setup.sh b/setup.sh
index 8437f72..bb6e736 100755
--- a/setup.sh
+++ b/setup.sh
@@ -525,7 +525,10 @@ run_advanced_menu() {
             unset to_install; local -a to_install=()   # fresh slate for next pick
         fi
     done
-    $done_any && ok "Optional tools installed."
+    # not `&& ok` — a false done_any would return 1 and kill the script under set -e
+    if [[ "$done_any" == "true" ]]; then
+        ok "Optional tools installed."
+    fi
 }
 
 # Per-category pre-repo wiring. Add third-party repos here when you add an
@@ -584,6 +587,25 @@ pause_if_debug
 
 step "8 Summary"
 rule
+
+# Post-install wiring that must see the FINAL package state. The libvirt
+# group add earlier (menu/module time) can miss packages installed later in
+# the same run — this is the authoritative pass (VM-proven: a fresh run left
+# the user out of the group when virt-manager landed after the check).
+ensure_libvirt_group() {
+    # shellcheck source=lib/common.sh
+    source "$SCRIPT_DIR/lib/common.sh" 2>/dev/null || true
+    if pkg_installed_any libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
+        || [[ -x /usr/sbin/libvirtd ]]; then
+        local real_user="${SUDO_USER:-$USER}"
+        if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
+            info "Adding $real_user to the libvirt group (re-login to apply)..."
+            sudo usermod -aG libvirt "$real_user" || true
+            warn "Group membership applies after re-login — do it before using virt-manager."
+        fi
+    fi
+}
+ensure_libvirt_group
 ok "DE:  $DE"
 ok "TWM: $TWM"
 ok "SELinux: $([[ "$SELINUX_DISABLED" == "true" ]] && echo disabled || echo keeping)"