diff --git a/scripts/setup/machine-setup/lib/base.sh b/scripts/setup/machine-setup/lib/base.sh
index ba76069f..9e135f92 100644
--- a/scripts/setup/machine-setup/lib/base.sh
+++ b/scripts/setup/machine-setup/lib/base.sh
@@ -189,9 +189,27 @@ ask_username() {
   else
     echo ""
     info "Which account is this machine for?"
-    echo "     The account you log in and work as — not root. It will be created"
+    echo "     The account you log in and work as, day to day. It will be created"
     echo "     if it does not exist."
     echo ""
+    warn "Strongly advised: use a normal account, not root."
+    echo "     Working as root means everything runs with no safety net. A typo in"
+    echo "     a path deletes instead of refusing, anything you run has the whole"
+    echo "     machine, and nothing distinguishes you from a process that got out"
+    echo "     of hand. sudo gives you the same power when you ask for it, and"
+    echo "     only then — which is why root is not accepted as an answer here."
+
+    # No SUDO_USER means this was started as root rather than through sudo, which
+    # usually means root is how they are logged in. That is exactly the situation
+    # the advice above is for, so it is worth saying plainly rather than leaving
+    # as general guidance they can assume is aimed at somebody else.
+    if [[ -z "${SUDO_USER:-}" ]]; then
+      echo ""
+      warn "You are running this as root directly, not through sudo."
+      echo "     If root is how you normally log into this machine, now is the"
+      echo "     moment to make an account and stop doing that."
+    fi
+    echo ""
     while [[ -z "${answer:-}" ]]; do
       if ! read -rp "  Username${default:+ [$default]}: " answer; then
         echo ""