diff --git a/services/actualbudget.sh b/services/actualbudget.sh
index 3cba7bf..373c599 100644
--- a/services/actualbudget.sh
+++ b/services/actualbudget.sh
@@ -219,7 +219,20 @@ _actualbudget_offer_authelia_oidc() {
 
     [ -d "$DOCKER_DIR/authelia" ] || return 0
     declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
-    grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null && return 0
+
+    # Confirmed live: a silent skip here (just `return 0`, no output) looked
+    # indistinguishable from the whole SSO step not running at all — a rerun
+    # against an .env that already had these vars (even from an earlier
+    # attempt that didn't fully complete) produced zero output, no prompt,
+    # nothing. Always say something instead, and offer to redo it.
+    if grep -q '^ACTUAL_OPENID_DISCOVERY_URL=' "$DIR/.env" 2>/dev/null; then
+        echo ""
+        log_info "Authelia SSO is already configured for Actual Budget (ACTUAL_OPENID_* already set in $DIR/.env)."
+        local RECONFIGURE=""
+        prompt_yn "  Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
+        [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
+        sed -i '/^ACTUAL_OPENID_/d' "$DIR/.env"
+    fi
 
     echo ""
     local USE_SSO=""
diff --git a/services/authelia.sh b/services/authelia.sh
index 37e929a..fba4e13 100644
--- a/services/authelia.sh
+++ b/services/authelia.sh
@@ -1038,24 +1038,36 @@ _authelia_scope_access() {
 
     local -a existing_users
     mapfile -t existing_users < <(_authelia_list_usernames "$users_file")
+    local i
     if [ "${#existing_users[@]}" -gt 0 ]; then
-        echo "  Existing Authelia users: ${existing_users[*]}"
+        echo "  Existing Authelia users:"
+        for i in "${!existing_users[@]}"; do
+            echo "    $((i + 1))) ${existing_users[$i]}"
+        done
+        echo "  Pick by number (space-separated), and/or type new usernames directly"
+        echo "  to create them — mix freely, e.g. \"1 3 newperson\"."
     else
-        echo "  No existing Authelia users yet — anyone you list below gets created fresh."
+        echo "  No existing Authelia users yet — type usernames below to create them fresh."
     fi
-    echo "  Usernames who should have access (space-separated). Anyone listed"
-    echo "  who doesn't already have an Authelia account gets one created —"
-    echo "  you'll get their temporary password to hand over. Typos against an"
-    echo "  existing name above create a new, separate account instead of"
-    echo "  matching it, so copy from that list rather than retyping from memory."
+    echo "  Anyone typed (not picked by number) who doesn't already have an"
+    echo "  Authelia account gets one created — you'll get their temporary"
+    echo "  password to hand over."
     local raw_users=""
-    prompt_text "  Usernames:" "" raw_users
-    local -a usernames
-    read -ra usernames <<< "$raw_users"
-    if [ "${#usernames[@]}" -eq 0 ]; then
+    prompt_text "  Usernames/numbers:" "" raw_users
+    local -a raw_tokens usernames
+    read -ra raw_tokens <<< "$raw_users"
+    if [ "${#raw_tokens[@]}" -eq 0 ]; then
         log_warning "No usernames entered — leaving $domain open to all Authelia users."
         return 0
     fi
+    local t
+    for t in "${raw_tokens[@]}"; do
+        if [[ "$t" =~ ^[0-9]+$ ]] && [ "$t" -ge 1 ] && [ "$t" -le "${#existing_users[@]}" ]; then
+            usernames+=("${existing_users[$((t - 1))]}")
+        else
+            usernames+=("$t")
+        fi
+    done
 
     local u start_end start end
     for u in "${usernames[@]}"; do
diff --git a/services/gitea.sh b/services/gitea.sh
index 9b6890e..f9ce2a4 100644
--- a/services/gitea.sh
+++ b/services/gitea.sh
@@ -255,7 +255,11 @@ _gitea_offer_authelia_sso() {
 _gitea_offer_actions_runner() {
     local DIR="$1"
 
-    grep -q '^  act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null && return 0
+    if grep -q '^  act_runner:$' "$DIR/docker-compose.yml" 2>/dev/null; then
+        log_info "Gitea Actions runner is already set up (act_runner service already in docker-compose.yml) — skipping."
+        log_info "Check its status: docker compose -f $DIR/docker-compose.yml ps act_runner"
+        return 0
+    fi
 
     echo ""
     local USE_ACTIONS=""
diff --git a/services/mealie.sh b/services/mealie.sh
index 1db4812..20de5c1 100644
--- a/services/mealie.sh
+++ b/services/mealie.sh
@@ -219,7 +219,18 @@ _mealie_offer_authelia_oidc() {
 
     [ -d "$DOCKER_DIR/authelia" ] || return 0
     declare -F _authelia_provision_oidc_client >/dev/null 2>&1 || return 0
-    grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null && return 0
+
+    # Same reasoning as the equivalent check in services/actualbudget.sh: a
+    # silent `return 0` here is indistinguishable from this step not
+    # running at all. Always say something, and offer to redo it.
+    if grep -q '^OIDC_AUTH_ENABLED=' "$DIR/.env" 2>/dev/null; then
+        echo ""
+        log_info "Authelia SSO is already configured for Mealie (OIDC_* already set in $DIR/.env)."
+        local RECONFIGURE=""
+        prompt_yn "  Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
+        [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
+        sed -i '/^OIDC_/d' "$DIR/.env"
+    fi
 
     local BASE_URL
     BASE_URL="$(grep '^BASE_URL=' "$DIR/.env" 2>/dev/null | cut -d= -f2-)"