diff --git a/scripts/setup/machine-setup/lib/docker.sh b/scripts/setup/machine-setup/lib/docker.sh
index ff1e885a..6d3baa71 100644
--- a/scripts/setup/machine-setup/lib/docker.sh
+++ b/scripts/setup/machine-setup/lib/docker.sh
@@ -72,7 +72,30 @@ install_docker_engine() {
     >/etc/apt/sources.list.d/docker.list
 
   pkg_refresh >/dev/null
-  pkg_install_now docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+  # ── The rootless prerequisites go in HERE, not in the rootless branch ──
+  #
+  # They used to be installed only when the owner picked "[2] rootless Docker for
+  # me" in section 22. But the OWNER's choice is not the only one that matters:
+  # every Developer account the platform provisions gets its own rootless daemon,
+  # whatever the owner picked for themselves. So on a machine where the owner chose
+  # the docker group, the host never got these and every member's daemon failed
+  # with `rootless Docker needs these packages on the host: uidmap`.
+  #
+  # `src/servers/os-user-docker.ts` → checkDockerPrerequisites is the authority on
+  # this list, and it wants both:
+  #
+  #   uidmap                      /usr/bin/newuidmap, /usr/bin/newgidmap
+  #   docker-ce-rootless-extras   /usr/bin/dockerd-rootless-setuptool.sh
+  #
+  # docker-ce only RECOMMENDS rootless-extras. That is installed by default, so it
+  # is usually there by luck — and is not on a host configured with
+  # --no-install-recommends. Named explicitly so it does not depend on that.
+  #
+  # dbus-user-session is what lets a member's systemd --user survive without a
+  # login session, which is how the daemon stays up.
+  pkg_install_now docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
+    docker-ce-rootless-extras uidmap dbus-user-session
 }
 
 # A shared network so containers from different compose files can reach each
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index 5f1dcfcf..089c0546 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -1761,7 +1761,9 @@ if ! skip; then
   elif ! docker_is_installed; then
     echo ""
     echo "     to install:   docker-ce, the CLI, containerd, buildx and compose,"
-    echo "                   from Docker's own repository"
+    echo "                   from Docker's own repository — plus uidmap,"
+    echo "                   dbus-user-session and docker-ce-rootless-extras,"
+    echo "                   which every member's own rootless daemon needs"
     if confirm "Install it?"; then
       if install_docker_engine; then
         ok "$(docker --version 2>/dev/null | cut -d, -f1) installed"