diff --git a/scripts/installer/auto-install.sh b/scripts/installer/auto-install.sh
index f35f38b..0dab81f 100755
--- a/scripts/installer/auto-install.sh
+++ b/scripts/installer/auto-install.sh
@@ -1,4 +1,17 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq disko nixos-install-tools
+# shellcheck shell=bash
+# The only genuinely external tools this script calls directly: `jq`
+# (parsing the `nix eval` host list) and `disko`/`nixos-install` (the
+# install itself). Everything disko shells out to internally
+# (parted/sgdisk/mkfs.*/zfs/...) is self-contained -- disko's own
+# generated scripts hardcode absolute Nix store paths for those, they
+# don't rely on this script's PATH at all (confirmed by inspecting a
+# generated system.build.formatScript). The built installer image
+# (modules/installer/common.nix) already has all three in
+# environment.systemPackages, so this nix-shell wrapper is a fast no-op
+# there; it's what makes the script also work standalone (e.g. run
+# directly from a checkout on a stock ISO), where they aren't.
 set -eux
 
 set -euo pipefail