diff --git a/run_once_00-install-bootstrap-tools.sh.tmpl b/run_once_00-install-bootstrap-tools.sh.tmpl
index ac5aae0..3d7f0fa 100755
--- a/run_once_00-install-bootstrap-tools.sh.tmpl
+++ b/run_once_00-install-bootstrap-tools.sh.tmpl
@@ -9,7 +9,9 @@ set -euo pipefail
 log() { printf '\033[1;34m[bootstrap]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[bootstrap ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 
-[[ "$(id -u)" -ne 0 ]] && die "must run as root or via sudo"
+# This script runs as the invoking user via `chezmoi apply`/`init`. It uses
+# sudo for system package installs. If sudo isn't passwordless, the user
+# will be prompted once per sudo invocation.
 
 {{ if eq .os_family "arch" -}}
 log "pacman-sync"
diff --git a/run_once_10-add-chaotic-aur.sh.tmpl b/run_once_10-add-chaotic-aur.sh.tmpl
index 1acd0dc..ab8417e 100755
--- a/run_once_10-add-chaotic-aur.sh.tmpl
+++ b/run_once_10-add-chaotic-aur.sh.tmpl
@@ -14,7 +14,8 @@ set -euo pipefail
 log() { printf '\033[1;34m[chaotic]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[chaotic ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 
-[[ "$(id -u)" -ne 0 ]] && die "must run as root or via sudo"
+# This script runs as the invoking user; sudo handles elevation for pacman
+# and pacman-key operations below.
 
 if command -v paru >/dev/null 2>&1; then
     log "paru already installed — skipping chaotic setup"