diff --git a/script/infra-setup.sh b/script/infra-setup.sh
index 51d7811..6779fd0 100755
--- a/script/infra-setup.sh
+++ b/script/infra-setup.sh
@@ -168,12 +168,21 @@ S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY."
         return 0
     fi
 
-    warn "bucket and service-account creation needs MinIO root credentials, which
-this script deliberately does not read. Run on $MINIO_HOST as an operator:
+    if ssh "$MINIO_HOST" "mc --version >/dev/null && test -d /srv/minio/$BUCKET"; then
+        ok "bucket $BUCKET exists"
+        return 0
+    fi
 
-  mc alias set local $MINIO_URL \"\$MINIO_ROOT_USER\" \"\$MINIO_ROOT_PASSWORD\"
+    warn "bucket and service-account creation needs the MinIO root credentials, which
+this script deliberately does not read -- they are root-equivalent for every bucket on
+that host, not just this one. Run there as an operator (architecture object-storage.md §3):
+
+  set -a; source <(sudo cat /etc/minio/minio.env); set +a
+  export MC_CONFIG_DIR=\$(mktemp -d); trap 'rm -rf \"\$MC_CONFIG_DIR\"' EXIT
+  mc alias set local http://127.0.0.1:9000 \"\$MINIO_ROOT_USER\" \"\$MINIO_ROOT_PASSWORD\"
   mc mb --ignore-existing local/$BUCKET
-  mc admin user svcacct add local \"\$MINIO_ROOT_USER\" --name rustingface
+  mc admin user svcacct add local \"\$MINIO_ROOT_USER\" --name $APP \\
+      --access-key '$APP-<8 random>' --policy <policy scoped to $BUCKET>
 
 then set the Gitea repo secrets S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY.
 Re-run this script with --skip-minio once that is done."
@@ -244,10 +253,18 @@ provision_proxy() {
     # A reload is a request, not a guarantee: nginx keeps its old cycle if it
     # cannot rebind, and then serves the certificate it loaded then. Compare
     # what is actually on the wire against what is on disk, by serial.
+    #
+    # Old workers finish their in-flight connections before exiting, so for a
+    # second or two after a reload either cycle may answer. Retry rather than
+    # report a mismatch that is really just the handover in progress.
     local served disk
-    served=$(echo | openssl s_client -servername ${VHOST}.internal -connect ${PROXY_HOST}:443 2>/dev/null \
-        | openssl x509 -noout -serial || echo "serial=unavailable")
     disk=$(ssh "$PROXY_HOST" "sudo openssl x509 -noout -serial -in $cert")
+    for _ in $(seq 1 10); do
+        served=$(echo | openssl s_client -servername ${VHOST}.internal -connect ${PROXY_HOST}:443 2>/dev/null \
+            | openssl x509 -noout -serial || echo "serial=unavailable")
+        [ "$served" = "$disk" ] && break
+        sleep 2
+    done
     if [ "$served" = "$disk" ]; then
         ok "the certificate on the wire matches the one on disk"
     else
@@ -260,7 +277,11 @@ Investigate the bind failure in the nginx error log, then restart nginx."
     fi
 
     info "DNS"
-    echo "    Add the split-horizon record if it is not already present:"
+    if getent hosts "${VHOST}.internal" >/dev/null; then
+        ok "${VHOST}.internal resolves"
+        return 0
+    fi
+    echo "    Add the split-horizon record on both routers:"
     echo "      opn-cli --config ~/.opn-cli/hanzalova.yml unbound host create \\"
     echo "          --hostname ${VHOST} --domain internal --server 10.6.0.46 \\"
     echo "          --description 'rustingface via hanzalova reverse proxy (bob backend)'"