diff --git a/install.sh b/install.sh
index 4e7d636..e9cbb63 100755
--- a/install.sh
+++ b/install.sh
@@ -292,29 +292,5 @@ fi
 echo "Running migrations..."
 run_migrations
 
-CONFIGURE_HINT="configure connects to your Federated Core, sets up backups and signs you in to the AI agents."
-
-# If the running kernel's modules are gone, a newer kernel was installed during
-# this run. configure waits for the reboot: until then, modules it needs, such
-# as Tailscale's tun and davfs2's fuse, can't be loaded.
-if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
-  echo "A newer kernel has been installed. Reboot, then run: configure"
-  echo "$CONFIGURE_HINT"
-  exit 0
-fi
-echo "Kernel is up to date, no reboot needed. You may want to consider a reboot if other significant software was updated or installed."
-
-# Offer configure only if something is still to do, as refresh runs this too.
-# This script is usually piped into bash, so ask on the terminal, not stdin.
-if ~/.local/bin/configure --list | grep -q '^to do'; then
-  echo
-  echo "$CONFIGURE_HINT"
-  if { : < /dev/tty; } 2> /dev/null && read -rp "Run configure now? [Y/n] " answer < /dev/tty \
-      && [[ "$answer" != [nN]* ]]; then
-    # Straight to the terminal, outside the log: sign-ins need a terminal, and
-    # their codes and links don't belong in a log
-    ~/.local/bin/configure < /dev/tty > /dev/tty 2>&1 || true
-  else
-    echo "To do it later, run: configure"
-  fi
-fi
+# Say the install worked, whether to reboot, and offer configure
+bash ~/.local/share/coredesktop/system/finish-install.sh
diff --git a/system/finish-install.sh b/system/finish-install.sh
new file mode 100644
index 0000000..c304e3b
--- /dev/null
+++ b/system/finish-install.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+#
+# Purpose : The end of install.sh: say the install worked, say whether to
+#           reboot, and offer configure if something is still to do. refresh
+#           runs install.sh too, so it may all be done already; the install
+#           still ends by saying it worked, so it can't be taken for a failure.
+
+# install.sh is usually piped into bash, so ask on the terminal
+TTY="${COREDESKTOP_TTY:-/dev/tty}"
+CONFIGURE="$HOME/.local/bin/configure"
+CONFIGURE_HINT="configure connects to your Federated Core, sets up backups and signs you in to the AI agents."
+
+echo
+echo -e "\e[32mCoreDesktop is installed.\e[0m"
+
+# If the running kernel's modules are gone, a newer kernel was installed during
+# this run. configure waits for the reboot: until then, modules it needs, such
+# as Tailscale's tun and davfs2's fuse, can't be loaded.
+if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
+  echo "A newer kernel has been installed. Reboot, then run: configure"
+  echo "$CONFIGURE_HINT"
+  exit 0
+fi
+echo "Kernel is up to date, no reboot needed. You may want to consider a reboot if other significant software was updated or installed."
+
+if "$CONFIGURE" --list | grep -q '^to do'; then
+  echo
+  echo "$CONFIGURE_HINT"
+  if { : < "$TTY"; } 2> /dev/null && read -rp "Run configure now? [Y/n] " answer < "$TTY" \
+      && [[ "$answer" != [nN]* ]]; then
+    # Straight to the terminal, outside the log: sign-ins need a terminal, and
+    # their codes and links don't belong in a log
+    "$CONFIGURE" < "$TTY" > "$TTY" 2>&1 || true
+  else
+    echo "To do it later, run: configure"
+  fi
+fi
diff --git a/tests/finish-install.bats b/tests/finish-install.bats
new file mode 100644
index 0000000..ccc5ad5
--- /dev/null
+++ b/tests/finish-install.bats
@@ -0,0 +1,71 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+# system/finish-install.sh with a fake uname and configure. The kernel is up to
+# date unless a test says otherwise: uname reports a kernel whose modules exist.
+
+setup() {
+  common_setup
+  KERNEL="$(ls /usr/lib/modules 2> /dev/null | head -n 1)"
+  export KERNEL
+  stub uname 'echo "$KERNEL"'
+  # configure --list prints $ITEMS; configure itself logs that it ran
+  export ITEMS="done   core           Federated Core"
+  mkdir -p "$HOME/.local/bin"
+  cat > "$HOME/.local/bin/configure" << 'STUB'
+#!/bin/bash
+echo "configure${*:+ $*}" >> "$STUB_LOG"
+[ "$1" = --list ] && printf '%s\n' "$ITEMS"
+exit 0
+STUB
+  chmod +x "$HOME/.local/bin/configure"
+  # No terminal unless a test gives answers
+  export COREDESKTOP_TTY="$BATS_TEST_TMPDIR/no-tty/tty"
+}
+
+needs_modules() {
+  [ -n "$KERNEL" ] || skip "needs a kernel in /usr/lib/modules"
+}
+
+answer() {
+  export COREDESKTOP_TTY="$BATS_TEST_TMPDIR/answer"
+  echo "$1" > "$COREDESKTOP_TTY"
+}
+
+@test "finish-install says the install worked when nothing is left to do" {
+  needs_modules
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."* ]]
+  [[ "$output" == *"no reboot needed"* ]]
+  [[ "$output" != *"configure connects"* ]]
+  uncalled configure
+}
+
+@test "finish-install says the install worked, then asks for a reboot after a new kernel" {
+  KERNEL=0.0.0-not-installed
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."*"Reboot, then run: configure"* ]]
+  not_called configure
+}
+
+@test "finish-install says the install worked before offering configure" {
+  needs_modules
+  ITEMS="to do  core           Federated Core"
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."*"configure connects"*"To do it later, run: configure"* ]]
+  uncalled configure
+}
+
+@test "finish-install runs configure when asked" {
+  needs_modules
+  ITEMS="to do  core           Federated Core"
+  answer y
+  run bash "$REPO/system/finish-install.sh"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"CoreDesktop is installed."* ]]
+  called configure
+}