diff --git a/setup/modules/shell-setup.sh b/setup/modules/shell-setup.sh
index 37c3579..7f56634 100755
--- a/setup/modules/shell-setup.sh
+++ b/setup/modules/shell-setup.sh
@@ -260,11 +260,15 @@ fi
 
 # ── Default shell change ───────────────────────────────────────────────────────
 # WHY: New login shells still default to bash unless explicitly changed.
-#      `chsh` writes the new shell to /etc/passwd for this user.
+#      This writes the new shell to /etc/passwd for this user.
 # HOW: Compare current $SHELL to /usr/bin/zsh and change if different.
+#      Use `sudo chsh` (not bare `chsh`): a bare chsh authenticates the calling
+#      user via PAM and prompts "Password:", which hangs an unattended install.
+#      Routing through sudo uses the passwordless setup rule, so it runs silently;
+#      `whoami` targets the right account whether run as the user or via runuser.
 if [ "$SHELL" != "/usr/bin/zsh" ]; then
     log "Setting zsh as default shell..."
-    chsh -s /usr/bin/zsh
+    sudo chsh -s /usr/bin/zsh "$(whoami)"
 else
     skip "zsh is already the default shell."
 fi