diff --git a/scripts/setup/officer-setup/lib/repo.sh b/scripts/setup/officer-setup/lib/repo.sh
index 5379d19b..8533afd6 100644
--- a/scripts/setup/officer-setup/lib/repo.sh
+++ b/scripts/setup/officer-setup/lib/repo.sh
@@ -14,17 +14,23 @@
 [[ -n "${OFFICER_SETUP_REPO_LOADED:-}" ]] && return 0
 OFFICER_SETUP_REPO_LOADED=1
 
-# SSH rather than HTTPS, temporarily: the repository is private, and an HTTPS
-# clone of a private repo prompts for a username — which under sudo, with no
-# interactive terminal, hangs or dies with "could not read Username".
+# Public HTTPS, which is what this needed all along.
 #
-# The clone runs as the OWNER, not as root (see the note above), so it uses their
-# ~/.ssh key. A passphrase-protected key normally answered by ssh-agent will not
-# work here: sudo drops SSH_AUTH_SOCK, so there is no agent to ask. An unencrypted
-# key, or one already accepted by the host, is what this expects.
+# It was ssh://git@gitea.pastilhas.dev:2222/... until 2026-08-14, and the reason was
+# that the repository was private: an HTTPS clone of a private repo prompts for a
+# username, and under sudo with no interactive terminal that hangs or dies with
+# "could not read Username". The note here said "back to HTTPS when the repository is
+# public", and it now is — verified with an anonymous `git ls-remote`.
 #
-# Back to HTTPS when the repository is public — nothing else here cares which.
-OFFICER_REPO="${OFFICER_REPO:-ssh://git@gitea.pastilhas.dev:2222/officerdev/platform.git}"
+# The change matters more than a URL swap. An SSH default cannot clone on a genuinely
+# fresh machine: the key machine-setup generates there is brand new and Gitea has
+# never seen it, so `--repo` was effectively mandatory on a first install. HTTPS needs
+# no key and no agent, so the default now works on a blank box.
+#
+# If this ever goes private again, SSH is the answer and the constraint above is the
+# reason — plus one more: the clone runs as the OWNER, and sudo drops SSH_AUTH_SOCK,
+# so a passphrase-protected key has no agent to answer it.
+OFFICER_REPO="${OFFICER_REPO:-https://gitea.officer.dev/officerdev/platform.git}"
 
 platform_dir() { echo "${OFFICER_ROOT}/platform"; }