diff --git a/install.sh b/install.sh
index a4bb3a3..c4df99e 100755
--- a/install.sh
+++ b/install.sh
@@ -202,8 +202,20 @@ env_example="$HERE/.env.example"
     echo "# .env is gitignored and never checked in."
     echo ""
     echo "# RTSP stream URLs — one line per camera (variable name = CAM_RTSP_<camname>)"
+    echo "#"
+    echo "# Use single quotes around the whole value to prevent shell interpretation."
+    echo "# Special characters in the PASSWORD must be URL-encoded (number-row reference):"
+    echo "#"
+    echo "#   !  %21    @  %40    #  %23    \$  %24    %  %25    ^  %5E"
+    echo "#   &  %26    *  %2A    (  %28    )  %29    -  safe    _  safe"
+    echo "#   +  %2B    =  %3D    ~  %7E    \`  %60    space  %20"
+    echo "#"
+    echo "# Also critical (break URL parsing if unencoded):  :  %3A    /  %2F"
+    echo "#"
+    echo "# Example: password  my@p\$ss:word!  ->  my%40p%24ss%3Aword%21"
+    echo ""
     for cam in "${CAMERAS[@]}"; do
-        echo "CAM_RTSP_${cam}=rtsp://admin:PASSWORD@192.168.1.XXX:554/stream1"
+        echo "CAM_RTSP_${cam}='rtsp://admin:PASSWORD@192.168.1.XXX:554/stream1'"
     done
     echo ""
     echo "# Mattermost upload"
@@ -218,6 +230,16 @@ env_example="$HERE/.env.example"
 } > "$env_example"
 echo "  wrote .env.example  (cp .env.example .env  then fill in real values)"
 
+# ── User-session prerequisites (non-system installs only) ────────────────────
+if ! $SYSTEM_MODE; then
+    # Make systemctl --user reachable when run outside a login session
+    export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+    # Start user services at boot even without an interactive login
+    loginctl enable-linger "$USER" \
+        && echo "  loginctl enable-linger: ok" \
+        || echo "  WARNING: loginctl enable-linger failed (may need to run manually)"
+fi
+
 # ── Reload and enable ─────────────────────────────────────────────────────────
 echo ""
 $SC daemon-reload
diff --git a/make-finals.sh b/make-finals.sh
index 9ede6a4..3817087 100755
--- a/make-finals.sh
+++ b/make-finals.sh
@@ -21,6 +21,8 @@ set -euo pipefail
 SCRIPT_DIR="$(dirname "$(realpath "$0")")"
 source "$SCRIPT_DIR/sky-cam.conf"
 export TIMEZONE
+ENCODE_PRESET="${ENCODE_PRESET:-slow}"
+CRF_SEASONS_FINAL="${CRF_SEASONS_FINAL:-26}"
 
 BACKUP_ROOT=""
 DRY_RUN=false
diff --git a/url-encode-password.sh b/url-encode-password.sh
new file mode 100755
index 0000000..d8714ea
--- /dev/null
+++ b/url-encode-password.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# url-encode-password.sh — URL-encode a password for use in an RTSP (or any) URL.
+#
+# Runs entirely locally.  The password is read without echoing, never written
+# to disk, never sent anywhere.  The encoded result is printed to stdout so
+# you can copy it straight into your .env file.
+#
+# Usage:
+#   ./url-encode-password.sh
+
+printf 'Password (not echoed): '
+read -rs password
+echo   # newline after silent input
+
+# Pass via environment variable — avoids any shell quoting / injection issues.
+encoded=$(PASSWORD="$password" python3 -c "
+import os, urllib.parse
+print(urllib.parse.quote(os.environ['PASSWORD'], safe=''))
+")
+
+echo "URL-encoded: $encoded"
+echo ""
+echo "Paste into .env like:"
+echo "  CAM_RTSP_<cam>='rtsp://admin:${encoded}@192.168.1.XXX:554/stream1'"