diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh
index 09b3d2b2..c5244882 100644
--- a/scripts/setup/machine-setup/lib/packages.sh
+++ b/scripts/setup/machine-setup/lib/packages.sh
@@ -29,6 +29,13 @@
 [[ -n "${MACHINE_SETUP_PACKAGES_LOADED:-}" ]] && return 0
 MACHINE_SETUP_PACKAGES_LOADED=1
 
+# What the last pkg_install/tools_install actually put on the machine, as opposed
+# to what it was asked for. Read by the caller to write an honest summary line:
+# without it every section reports its whole list as installed, including the
+# packages it deliberately left alone.
+LAST_INSTALLED=()
+LAST_KEPT=()
+
 # -----------------------------------------------------------------------------
 # The sections
 # -----------------------------------------------------------------------------
@@ -152,6 +159,9 @@ pkg_install() {
     if pkg_is_installed "$pkg"; then present+=("$pkg"); else missing+=("$pkg"); fi
   done
 
+  LAST_INSTALLED=("${missing[@]}")
+  LAST_KEPT=("${present[@]}")
+
   info "$label — installs what is missing, keeps what you already have"
   ((${#present[@]})) && echo "     already here: ${present[*]}"
 
@@ -163,3 +173,16 @@ pkg_install() {
   echo "     to install:   ${missing[*]}"
   pkg_install_now "${missing[@]}"
 }
+
+# One summary line describing what a section actually did, from LAST_INSTALLED
+# and LAST_KEPT. Call straight after pkg_install or tools_install.
+summarise_last() {
+  local label="$1"
+  if ((${#LAST_INSTALLED[@]} == 0)); then
+    SUMMARY+=("$label: already present, nothing installed")
+  elif ((${#LAST_KEPT[@]} == 0)); then
+    SUMMARY+=("$label installed: ${LAST_INSTALLED[*]}")
+  else
+    SUMMARY+=("$label installed: ${LAST_INSTALLED[*]} (${#LAST_KEPT[@]} already present)")
+  fi
+}
diff --git a/scripts/setup/machine-setup/lib/tools.sh b/scripts/setup/machine-setup/lib/tools.sh
index f13874d6..c49df44d 100644
--- a/scripts/setup/machine-setup/lib/tools.sh
+++ b/scripts/setup/machine-setup/lib/tools.sh
@@ -113,6 +113,9 @@ tools_install() {
     if tool_is_installed "$tool"; then present+=("$tool"); else missing+=("$tool"); fi
   done
 
+  LAST_INSTALLED=("${missing[@]}")
+  LAST_KEPT=("${present[@]}")
+
   info "$label — installs what is missing, keeps what you already have"
   ((${#present[@]})) && echo "     already here: ${present[*]}"
 
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index 23142e1e..7540532e 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -91,8 +91,8 @@ if ! skip; then
   # shellcheck disable=SC2046  # word splitting is how the list is passed
   pkg_install "Core packages" $(pkgs_core)
 
+  summarise_last "Core packages"
   ok "System updated and core packages in place"
-  SUMMARY+=("System packages updated, core packages installed")
   step_ok
 fi
 
@@ -109,8 +109,7 @@ step "Command-line tools"
 if ! skip; then
   # shellcheck disable=SC2046  # word splitting is how the list is passed
   tools_install "Command-line tools" $(tools_default)
-
-  SUMMARY+=("Command-line tools: $(tools_default)")
+  summarise_last "Command-line tools"
   step_ok
 fi