diff --git a/README.md b/README.md
index 29ee6a0..3406e6a 100644
--- a/README.md
+++ b/README.md
@@ -141,11 +141,25 @@ echo "cloud-init.sh: repo cloned to $DEST — the setup wizard will launch on fi
 sudo ./setup.sh                        # interactive wizard
 sudo ./setup.sh caddy immich           # install specific services
 sudo ./setup.sh configure              # set site defaults (timezone, domain, Caddy network)
+sudo ./setup.sh filebrowser --remove   # remove a service (or: sudo ./setup.sh filebrowser remove)
 ./setup.sh --list                      # list all services grouped by category
 sudo ./setup.sh --dry-run immich       # preview without making changes
 sudo ./setup.sh --unattended base      # non-interactive, use defaults
 ```
 
+### Tab completion
+
+```bash
+echo "source $(pwd)/tools/setup-completion.bash" >> ~/.bashrc
+source ~/.bashrc
+```
+
+Then `./setup.sh mat<TAB>` completes to `./setup.sh mattermost` — same for
+flags (`--li<TAB>` → `--list`). Works with a leading `sudo` too. The service
+list is read fresh from `services/*.sh` on every completion, not a
+hardcoded list baked into the script — a service added since you last
+pulled shows up immediately, no re-running anything.
+
 ## What the wizard does
 
 **First run:**
diff --git a/services/beszel.sh b/services/beszel.sh
index 9a02041..242f4cd 100644
--- a/services/beszel.sh
+++ b/services/beszel.sh
@@ -259,7 +259,7 @@ services:
     volumes:
       - ./beszel_data:/beszel_data
       - ./beszel_socket:/beszel_socket
-${_CADDY_NET_BLOCK}${_CADDY_NET_SECTION}
+${_CADDY_NET_BLOCK}
   beszel-agent:
     image: henrygd/beszel-agent:latest
     container_name: beszel-agent
@@ -275,6 +275,7 @@ ${_CADDY_NET_BLOCK}${_CADDY_NET_SECTION}
       - ./beszel_agent_data:/var/lib/beszel-agent
       - ./beszel_socket:/beszel_socket
       - /var/run/docker.sock:/var/run/docker.sock:ro
+${_CADDY_NET_SECTION}
 BESZEL_COMPOSE
 
     # APP_URL only matters for the hub's own generated links and origin
diff --git a/tools/setup-completion.bash b/tools/setup-completion.bash
new file mode 100644
index 0000000..93667b6
--- /dev/null
+++ b/tools/setup-completion.bash
@@ -0,0 +1,34 @@
+# tools/setup-completion.bash — bash tab-completion for setup.sh.
+#
+# Enable it:
+#   echo "source $(pwd)/tools/setup-completion.bash" >> ~/.bashrc
+#   source ~/.bashrc
+# (run that echo from the repo root, or swap $(pwd) for the actual path)
+#
+# Then: ./setup.sh mat<TAB>  ->  ./setup.sh mattermost
+# Works with a leading `sudo` too (sudo ./setup.sh mat<TAB>) via the
+# bash-completion package's standard sudo pass-through, already enabled by
+# default on Ubuntu — nothing extra needed for that part.
+#
+# Service names are read fresh from services/*.sh every time you press
+# <TAB> — never a hardcoded list baked in here. This repo's own rule is
+# "adding a service = adding one file, nothing generated" (see CLAUDE.md);
+# a completion script that needed regenerating every time a service got
+# added would quietly break that promise the first time someone forgot.
+
+_setup_sh_completions() {
+    local cur repo_dir services flags
+    cur="${COMP_WORDS[COMP_CWORD]}"
+
+    # Self-locating from this file's own path, not a hardcoded install
+    # location — survives the repo being cloned anywhere, or moved later.
+    repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)"
+    [ -d "$repo_dir/services" ] || return 0
+
+    services="$(cd "$repo_dir/services" && for f in *.sh; do [ -f "$f" ] && printf '%s ' "${f%.sh}"; done)"
+    flags="--list --status --dry-run --unattended --remove remove uninstall --version --help configure"
+
+    COMPREPLY=( $(compgen -W "${services}${flags}" -- "$cur") )
+}
+
+complete -F _setup_sh_completions setup.sh ./setup.sh