diff --git a/README.md b/README.md
index 73b5bb7..03af2e1 100644
--- a/README.md
+++ b/README.md
@@ -124,13 +124,14 @@ and for Graylog to report healthy.
 
 ### 4. Read the admin credentials
 
+`install-graylog.sh` prints the generated admin user/password once, at the
+end of a successful fresh run, and deletes the one-time credentials file
+right after - nothing further to do. If you missed it (or the run died
+before reaching that point), it's still sitting at
+`/opt/graylog/.admin_credentials_ONE_TIME` until you read it:
 ```bash
 ssh claude-deploy@<proxmox-host> "sudo pct exec 210 -- cat /opt/graylog/.admin_credentials_ONE_TIME"
 ```
-Copy the password into your password manager, then delete the file:
-```bash
-ssh claude-deploy@<proxmox-host> "sudo pct exec 210 -- rm /opt/graylog/.admin_credentials_ONE_TIME"
-```
 Log into `http://<public-ip>:<port>/` with user `admin` and that password.
 
 ### 5. Reach the Web UI from outside the management network (if needed)
@@ -610,8 +611,10 @@ Inside the container, everything lives under `/opt/graylog/`
 
 `install-graylog.sh` generates `GRAYLOG_PASSWORD_SECRET` and a random
 admin password on first run, writing the admin password once to
-`/opt/graylog/.admin_credentials_ONE_TIME` inside the container — read
-it, store it in your password manager, then delete the file:
+`/opt/graylog/.admin_credentials_ONE_TIME` inside the container. The
+script itself prints it and deletes the file automatically at the end of
+a successful run - store it in your password manager then. If the run
+died before reaching that point, read and remove the file by hand:
 ```bash
 pct exec <VMID> -- cat /opt/graylog/.admin_credentials_ONE_TIME
 pct exec <VMID> -- rm /opt/graylog/.admin_credentials_ONE_TIME
diff --git a/README.uk.md b/README.uk.md
index 1d0ec1a..c89db65 100644
--- a/README.uk.md
+++ b/README.uk.md
@@ -125,13 +125,14 @@ net.ipv4.ip_unprivileged_port_start: permission denied`) — це очікува
 
 ### 4. Прочитати креденшели адміністратора
 
+`install-graylog.sh` сам виводить згенерований логін/пароль адміна один
+раз, наприкінці успішного свіжого прогону, і одразу видаляє одноразовий
+файл — більше нічого робити не треба. Якщо пропустили (або прогін впав
+раніше цього моменту), файл усе ще лежить у
+`/opt/graylog/.admin_credentials_ONE_TIME`, поки не прочитаєте:
 ```bash
 ssh claude-deploy@<proxmox-host> "sudo pct exec 210 -- cat /opt/graylog/.admin_credentials_ONE_TIME"
 ```
-Скопіюйте пароль у менеджер паролів, потім видаліть файл:
-```bash
-ssh claude-deploy@<proxmox-host> "sudo pct exec 210 -- rm /opt/graylog/.admin_credentials_ONE_TIME"
-```
 Зайдіть на `http://<публічний-ip>:<порт>/` під користувачем `admin` з цим
 паролем.
 
@@ -628,8 +629,10 @@ streams/*.json           # визначення Graylog Stream (маршрути
 `install-graylog.sh` генерує `GRAYLOG_PASSWORD_SECRET` та випадковий
 пароль адміністратора під час першого запуску, одноразово записуючи
 пароль адміністратора у `/opt/graylog/.admin_credentials_ONE_TIME`
-всередині контейнера — прочитайте його, збережіть у менеджері паролів,
-а потім видаліть файл:
+всередині контейнера. Сам скрипт виводить його і автоматично видаляє
+файл наприкінці успішного прогону — збережіть пароль у менеджері паролів
+тоді ж. Якщо прогін впав раніше цього моменту, прочитайте й видаліть файл
+вручну:
 ```bash
 pct exec <VMID> -- cat /opt/graylog/.admin_credentials_ONE_TIME
 pct exec <VMID> -- rm /opt/graylog/.admin_credentials_ONE_TIME
diff --git a/install-graylog.sh b/install-graylog.sh
index 1a2ad56..4c556ae 100644
--- a/install-graylog.sh
+++ b/install-graylog.sh
@@ -3,6 +3,12 @@
 # Idempotent: safe to re-run after a partial failure.
 set -euo pipefail
 
+# The container inherits LANG=en_US.UTF-8 from the calling shell (pct exec),
+# but that locale is never generated here - just noisy "Setting locale
+# failed" warnings from perl/apt-listchanges on every apt-get call. C.UTF-8
+# is glibc-builtin (no locale-gen needed) and silences them.
+export LC_ALL=C.UTF-8 LANG=C.UTF-8
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 INSTALL_DIR="/opt/graylog"
 GRAYLOG_EXTERNAL_URI="${GRAYLOG_EXTERNAL_URI:?Set GRAYLOG_EXTERNAL_URI, e.g. http://93.171.241.5:9000/}"
@@ -136,11 +142,13 @@ EOF
   cat > "$INSTALL_DIR/.admin_credentials_ONE_TIME" <<EOF
 Graylog admin user: $ADMIN_USER
 Graylog admin password: $admin_pass
-(This file is only written once, at first install. Store the password in your
-password manager, then delete this file: rm $INSTALL_DIR/.admin_credentials_ONE_TIME)
+(This file is only written once, at first install. install-graylog.sh prints
+this password and deletes this file automatically once the run finishes
+successfully. If the script dies before that, delete it yourself once
+you've stored the password: rm $INSTALL_DIR/.admin_credentials_ONE_TIME)
 EOF
   chmod 600 "$INSTALL_DIR/.admin_credentials_ONE_TIME"
-  ok "Admin password generated. See $INSTALL_DIR/.admin_credentials_ONE_TIME (read it now, then delete it)."
+  ok "Admin password generated (shown and deleted at the end of this run if the whole script succeeds)."
 }
 
 step_compose_up() {
@@ -493,7 +501,10 @@ main() {
   echo " Web UI: $GRAYLOG_EXTERNAL_URI" >&2
   echo " Config: $INSTALL_DIR/docker-compose.yml and $INSTALL_DIR/.env" >&2
   if [ -f "$INSTALL_DIR/.admin_credentials_ONE_TIME" ]; then
-    echo " Admin credentials: $INSTALL_DIR/.admin_credentials_ONE_TIME (read once, then delete)" >&2
+    echo " Admin user:     $ADMIN_USER" >&2
+    echo " Admin password: $ADMIN_PASSWORD" >&2
+    echo " (shown once above - store it now; the one-time file is being deleted)" >&2
+    rm -f "$INSTALL_DIR/.admin_credentials_ONE_TIME"
   fi
   echo "${C_GREEN}==================================================${C_RESET}" >&2
 }