diff --git a/setup.sh b/setup.sh
index 6669191..eebb264 100755
--- a/setup.sh
+++ b/setup.sh
@@ -26,6 +26,31 @@ set -uo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# ── Self-install a PATH wrapper, so "cd into the repo every time" stops
+# being necessary after the first run ────────────────────────────────────
+# ${BASH_SOURCE[0]}-based HERE above means a plain symlink into
+# /usr/local/bin wouldn't resolve correctly (bash doesn't follow symlinks
+# for BASH_SOURCE, so a symlinked invocation would set HERE to the
+# symlink's own directory, not this repo's) — a thin wrapper that execs
+# THIS checkout's setup.sh by its real, already-resolved path sidesteps
+# that entirely. Runs on every invocation (bare, --list/--status, or a
+# service name) but is idempotent and silent unless something actually
+# needs writing, so it doesn't add noise to a normal run. Root-only: a
+# non-root invocation (e.g. --list) can't write to /usr/local/bin anyway,
+# and skipping silently beats a permission-denied on every read-only
+# command.
+if [ "${EUID:-$(id -u)}" -eq 0 ]; then
+    _CLI_WRAPPER="/usr/local/bin/post-install"
+    _WANT_WRAPPER="#!/bin/bash
+exec \"${HERE}/setup.sh\" \"\$@\""
+    if [ "$(cat "$_CLI_WRAPPER" 2>/dev/null)" != "$_WANT_WRAPPER" ]; then
+        if printf '%s\n' "$_WANT_WRAPPER" > "$_CLI_WRAPPER" 2>/dev/null && chmod +x "$_CLI_WRAPPER" 2>/dev/null; then
+            echo "[INFO] Installed 'post-install' — run it from anywhere from now on (e.g. post-install asterisk)."
+        fi
+    fi
+    unset _CLI_WRAPPER _WANT_WRAPPER
+fi
+
 # whiptail requires a valid TERM; when piped through bash (curl | bash) TERM
 # may be unset, causing raw-mode to fail and arrow keys to leak to the shell.
 export TERM="${TERM:-xterm-256color}"