diff --git a/scripts/setup/machine-setup/lib/base.sh b/scripts/setup/machine-setup/lib/base.sh
index a02b1ccd..ee627b31 100644
--- a/scripts/setup/machine-setup/lib/base.sh
+++ b/scripts/setup/machine-setup/lib/base.sh
@@ -120,10 +120,17 @@ load_answers() {
     [[ "$key" =~ ^[A-Z_]+$ ]] || continue
     [[ -n "$value" ]] || continue
     # The environment wins over what was saved.
+    #
+    # Written as if/then rather than `[[ … ]] && assign`. That form returns
+    # non-zero when the test is false, and as the last statement in a loop body
+    # under `set -e` it takes the whole script down — which is exactly what
+    # happened the first time this ran with the variables already set in the
+    # environment: the file loaded fine, every value was already present, and the
+    # run died at "Step: unknown" before pre-flight.
     case "$key" in
-      MACHINE_ROLE) [[ -z "${MACHINE_ROLE:-}" ]] && MACHINE_ROLE="$value" ;;
-      SETUP_USERNAME) [[ -z "${SETUP_USERNAME:-}" ]] && SETUP_USERNAME="$value" ;;
-      OFFICER_ROOT) [[ -z "${OFFICER_ROOT:-}" ]] && OFFICER_ROOT="$value" ;;
+      MACHINE_ROLE) if [[ -z "${MACHINE_ROLE:-}" ]]; then MACHINE_ROLE="$value"; fi ;;
+      SETUP_USERNAME) if [[ -z "${SETUP_USERNAME:-}" ]]; then SETUP_USERNAME="$value"; fi ;;
+      OFFICER_ROOT) if [[ -z "${OFFICER_ROOT:-}" ]]; then OFFICER_ROOT="$value"; fi ;;
     esac
   done <"$ANSWERS_FILE"
 }
diff --git a/scripts/setup/machine-setup/lib/tailscale.sh b/scripts/setup/machine-setup/lib/tailscale.sh
index a64a0128..7a9df689 100644
--- a/scripts/setup/machine-setup/lib/tailscale.sh
+++ b/scripts/setup/machine-setup/lib/tailscale.sh
@@ -55,6 +55,20 @@ tailscale_help() {
   echo "     lock you out of the machine, so there is always a second way in."
 }
 
+# The menu itself, in a function because it is shown twice — once to ask, and
+# again after ? has printed the long answer, so the reader is not dropped back at
+# a bare prompt having forgotten what the options were.
+tailscale_network_menu() {
+  info "Which network should this machine join?"
+  echo ""
+  echo "     [1] set up your own network        (offscale)"
+  echo "         offscale is just tailscale and headscale, with our own sugar on top"
+  echo "     [2] use a network you already run  (headscale, offscale)"
+  echo "     [3] the easy route                 (tailscale.com)"
+  echo "     [?] what are tailscale, headscale and offscale?"
+  echo ""
+}
+
 # The long answer, printed when somebody types ?. Covers all three names,
 # because the menu offers all three and two of them are not words anyone outside
 # this project would know.
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index b723ac15..6929ecc7 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -441,13 +441,7 @@ if ! skip; then
       SUMMARY+=("Tailscale: connected, unchanged ($(tailscale_ip))")
     else
       echo ""
-      info "Which network should this machine join?"
-      echo ""
-      echo "     [1] set up your own network        (offscale)"
-      echo "     [2] use a network you already run  (headscale, offscale)"
-      echo "     [3] the easy route                 (tailscale.com)"
-      echo "     [?] what are tailscale, headscale and offscale?"
-      echo ""
+      tailscale_network_menu
 
       TS_LOGIN_SERVER=""
       TS_PLANE=""
@@ -478,13 +472,7 @@ if ! skip; then
             echo ""
             tailscale_networks_help
             echo ""
-            info "Which network should this machine join?"
-            echo ""
-            echo "     [1] set up your own network        (offscale)"
-            echo "     [2] use a network you already run  (headscale, offscale)"
-            echo "     [3] the easy route                 (tailscale.com)"
-            echo "     [?] what are tailscale, headscale and offscale?"
-            echo ""
+            tailscale_network_menu
             ;;
           *) warn "Pick 1, 2, 3 or ?." ;;
         esac