diff --git a/gnome/gnome-extensions.sh b/gnome/gnome-extensions.sh
index f57ddf3..b96d26a 100755
--- a/gnome/gnome-extensions.sh
+++ b/gnome/gnome-extensions.sh
@@ -27,8 +27,10 @@ for ext in "${EXTENSIONS[@]}"; do
   fi
 
   echo "Installing extension: $ext..."
-  ~/.local/bin/gext install "$ext"
-  ~/.local/bin/gext enable "$ext"
+  # The filesystem backend installs without GNOME Shell's confirmation dialog;
+  # the extension loads at next login
+  ~/.local/bin/gext --filesystem install "$ext"
+  ~/.local/bin/gext --filesystem enable "$ext"
   echo "  Installed and enabled: $ext"
 done
 
diff --git a/install.sh b/install.sh
index bbc3084..3b13667 100755
--- a/install.sh
+++ b/install.sh
@@ -155,8 +155,8 @@ echo "Configuring Bitwarden SSH agent..."
 . bitwarden.sh
 
 # Add the current user to the docker group and start the Docker daemon
+# Group membership takes effect at next login (newgrp would start an interactive shell)
 sudo usermod -aG docker $USER
-newgrp docker
 sudo systemctl enable docker.service
 sudo systemctl start docker.service
 
@@ -180,18 +180,7 @@ fi
 # Check whether the running kernel matches the installed modules — if not, a
 # newer kernel was installed during this run and a reboot is required
 if ! ls /usr/lib/modules/$(uname -r) > /dev/null 2>&1; then
-  echo "A newer kernel has been installed, a reboot is recommended."
-  read -rp "Reboot now? [y/N] " response
-  case "$response" in
-    [yY][eE][sS]|[yY])
-      echo "Rebooting..."
-      sudo reboot
-      ;;
-    *)
-      echo "Reboot skipped. Please remember to reboot when convenient."
-      exit 0
-      ;;
-  esac
+  echo "A newer kernel has been installed. Please reboot when convenient."
 else
   echo "Kernel is up to date, no reboot needed. You may want to consider a reboot if other significant software was updated or installed."
 fi
diff --git a/update b/update
index 42f04ad..831078d 100755
--- a/update
+++ b/update
@@ -48,6 +48,13 @@ if [[ -z "$UPDATE_REEXECED" ]]; then
     exec ~/.local/bin/update
 fi
 
+# Ask for the password once, then keep sudo's cached credentials fresh until
+# update exits, so long-running hooks don't stop for a password again.
+sudo -v || exit 1
+while kill -0 $$ 2>/dev/null; do sudo -n -v; sleep 60; done 2>/dev/null &
+SUDO_KEEPALIVE_PID=$!
+trap 'kill "$SUDO_KEEPALIVE_PID" 2>/dev/null' EXIT
+
 FAILED=()
 [[ -n "$UPDATE_PULL_FAILED" ]] && FAILED+=("git pull")
 
diff --git a/updates.d/10-pacman.sh b/updates.d/10-pacman.sh
index c11c392..bde676f 100644
--- a/updates.d/10-pacman.sh
+++ b/updates.d/10-pacman.sh
@@ -11,7 +11,7 @@ remove_packages "${REMOVE_PACMAN[@]}"
 remove_flatpaks "${REMOVE_FLATPAKS[@]}"
 
 echo "Updating Arch..."
-sudo pacman -Syu
+sudo pacman -Syu --noconfirm
 
 echo "Checking for new packages..."
 install_packages "${SYSTEM_UTILS[@]}"
diff --git a/updates.d/20-aur.sh b/updates.d/20-aur.sh
index 346806f..c022b22 100644
--- a/updates.d/20-aur.sh
+++ b/updates.d/20-aur.sh
@@ -6,11 +6,12 @@ YAY_FLAGS="--noconfirm --answerdiff=None --answeredit=None --answerclean=None"
 
 if ! yay -Sua $YAY_FLAGS 2>/dev/null; then
     echo "yay -Sua returned an error. Let's rebuild YAY."
-    sudo pacman -R yay
+    sudo pacman -R --noconfirm yay
     cd /tmp
+    rm -rf yay
     git clone https://aur.archlinux.org/yay.git
     cd yay
-    makepkg -si
+    makepkg -si --noconfirm
     cd ..
     rm -rf yay
     cd
diff --git a/updates.d/40-ruby.sh b/updates.d/40-ruby.sh
index 3b57753..4d05984 100644
--- a/updates.d/40-ruby.sh
+++ b/updates.d/40-ruby.sh
@@ -1,5 +1,8 @@
 #!/bin/bash
 
+# Answer yes to any mise prompt (e.g. trusting config files)
+export MISE_YES=1
+
 echo "Updating mise..."
 mise self-update -y