diff --git a/setup.sh b/setup.sh
index c5a01d0..362402b 100644
--- a/setup.sh
+++ b/setup.sh
@@ -23,17 +23,30 @@ if [[ $EUID -ne 0 ]]; then
 fi
 
 ###############################################################################
-# Logging                                                                    #
+# Logging & helpers                                                           #
 ###############################################################################
+LOGFILE="/var/log/freshbox.log"
+exec &> >(tee -a "$LOGFILE")
+
+# Colors
+RED=$'\e[31m'; YLW=$'\e[33m'; CLR=$'\e[0m'
+# Error exit
+die() { echo -e "${RED}[ERROR] $*${CLR}" >&2; exit 1; }
+# Install packages quietly
 ensure_pkgs() { apt-get -qq update; apt-get -y install "$@"; }
+# Message dialog or stdout
 msg() { if command -v whiptail &>/dev/null; then whiptail --title "Setup" --msgbox "$1" 10 60; else echo -e "${YLW}$1${CLR}"; fi; }
-confirm() { whiptail --yesno "$1" 10 60; }
+# Yes/No dialog (returns success on Yes)
+confirm() { if command -v whiptail &>/dev/null; then whiptail --yesno "$1" 10 60; else return 0; fi; }
+# Gauge progress for long tasks
 gauge_run() {
     local MESSAGE=$1; shift
     (
-        "$@" & CMD_PID=$!
+        # Run the command quietly, hide stdout/stderr, background it
+        "$@" > /dev/null 2>&1 & CMD_PID=$!
         while kill -0 "$CMD_PID" 2>/dev/null; do
-            echo "XXX"; echo 50; echo "$MESSAGE"; echo "XXX"; sleep 1
+            echo "XXX"; echo 50; echo "$MESSAGE"; echo "XXX"
+            sleep 1
         done
     ) | whiptail --gauge "$MESSAGE" 6 60 0
 }
@@ -86,6 +99,24 @@ sed -i "s/$OLD_HOST/$NEW_HOST/g" /etc/hosts
 hostnamectl set-hostname "$NEW_HOST"
 msg "Hostname set to $NEW_HOST"
 
+###############################################################################
+# SSH keys for root                                                           #
+###############################################################################
+install -d -m 700 /root/.ssh
+chmod 700 /root/.ssh
+test -n "$DEFAULT_SSH_KEY" && {
+    grep -qxF "$DEFAULT_SSH_KEY" /root/.ssh/authorized_keys 2>/dev/null || \
+        echo "$DEFAULT_SSH_KEY" >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+    msg "Default SSH key added for root"
+}
+if confirm "Add additional SSH public key for root?"; then
+    KEY=$(whiptail --title "SSH Key (root)" --inputbox "Paste your public key for root:" 12 70 3>&1 1>&2 2>&3) || die "Cancelled"
+    grep -qxF "$KEY" /root/.ssh/authorized_keys 2>/dev/null || echo "$KEY" >> /root/.ssh/authorized_keys
+    chmod 600 /root/.ssh/authorized_keys
+    msg "Additional SSH key added for root"
+fi
+
 ###############################################################################
 # SSH keys for user jordanwages                                              #
 ###############################################################################
@@ -94,7 +125,8 @@ USER_HOME="/home/$USER_NAME"
 install -d -m 700 "$USER_HOME/.ssh"
 chown $USER_NAME:$USER_NAME "$USER_HOME/.ssh"
 test -n "$DEFAULT_SSH_KEY" && {
-    grep -qxF "$DEFAULT_SSH_KEY" "$USER_HOME/.ssh/authorized_keys" 2>/dev/null || echo "$DEFAULT_SSH_KEY" >> "$USER_HOME/.ssh/authorized_keys"
+    grep -qxF "$DEFAULT_SSH_KEY" "$USER_HOME/.ssh/authorized_keys" 2>/dev/null || \
+        echo "$DEFAULT_SSH_KEY" >> "$USER_HOME/.ssh/authorized_keys"
     chown $USER_NAME:$USER_NAME "$USER_HOME/.ssh/authorized_keys"
     chmod 600 "$USER_HOME/.ssh/authorized_keys"
     msg "Default SSH key added for $USER_NAME"
@@ -117,6 +149,7 @@ SEL_RAW=$(whiptail --title "Extra Utilities" --checklist \
     "${OPTS[@]}" 3>&1 1>&2 2>&3) || true
 IFS=' ' read -r -a SEL_PKGS <<< "${SEL_RAW//\"/}"
 ensure_pkgs bat ncdu neofetch cifs-utils "${SEL_PKGS[@]}"
+# Aliases
 echo "alias cat='batcat --paging=never'" >/etc/profile.d/10-bat_alias.sh
 echo "alias du='ncdu'" >/etc/profile.d/10-ncdu_alias.sh
 chmod +x /etc/profile.d/10-*alias.sh
@@ -145,7 +178,7 @@ for host in "${CIFS_HOSTS[@]}"; do
         grep -q "${host}.wageshouse" /etc/fstab || printf "# $TEMPLATE\n" "username" "password" >> /etc/fstab
     fi
 done
-if ! (systemctl daemon-reload && mount -a) 2>>"$LOGFILE"; then msg "⚠️  Some CIFS mounts failed. Re-run the script to correct credentials."; fi
+if ! mount -a 2>>"$LOGFILE"; then msg "⚠️  Some CIFS mounts failed. Re-run the script to correct credentials."; fi
 
 ###############################################################################
 # Summary                                                                    #