diff --git a/fallback-ap.sh b/fallback-ap.sh
index 45021bd..f531b34 100644
--- a/fallback-ap.sh
+++ b/fallback-ap.sh
@@ -3,16 +3,41 @@
 set -e
 
 # Configuration =======================================================================================================
+#
+# Connection settings (SSID, passphrase, subnet, DHCP range, interface) can
+# be supplied three ways, highest priority first:
+#   1. Environment variables (FALLBACK_AP_*) - used for headless installs.
+#   2. The persisted config file below, written by `install`.
+#   3. The hard-coded defaults in this block.
+#
+# Everything else (timers, paths) is not meant to be reconfigured per-install
+# and stays as plain constants.
 
-WLAN0_IFACE="wlan0"
+CONFIG_FILE="/etc/fallback-ap.conf"
 
-AP_NAME="${HOSTNAME}"
-AP_PASSWORD='guesswhatitis'
-AP_ENCRYPTION="wpa-psk" # none | wpa-psk | sae
+# Load persisted settings from a previous install, if any. These are stored
+# under SAVED_* names (not FALLBACK_AP_*) specifically so that sourcing this
+# file can never clobber an explicit environment-variable override below.
+if [ -f "$CONFIG_FILE" ]; then
+    # shellcheck disable=SC1090
+    source "$CONFIG_FILE"
+fi
 
-AP_CIDR="10.10.10.1/24"
-DHCP_START="10.10.10.100"
-DHCP_END="10.10.10.250"
+WLAN0_IFACE="${FALLBACK_AP_IFACE:-${SAVED_IFACE:-wlan0}}"
+
+AP_NAME="${FALLBACK_AP_SSID:-${SAVED_SSID:-$HOSTNAME}}"
+AP_PASSWORD="${FALLBACK_AP_PASSWORD:-${SAVED_PASSWORD:-guesswhatitis}}"
+AP_ENCRYPTION="${FALLBACK_AP_ENCRYPTION:-${SAVED_ENCRYPTION:-wpa-psk}}" # none | wpa-psk | sae
+
+FALLBACK_AP_CIDR="${FALLBACK_AP_CIDR:-${SAVED_CIDR:-10.10.10.1/24}}"
+FALLBACK_AP_DHCP_START_OCTET="${FALLBACK_AP_DHCP_START_OCTET:-${SAVED_DHCP_START_OCTET:-100}}"
+FALLBACK_AP_DHCP_END_OCTET="${FALLBACK_AP_DHCP_END_OCTET:-${SAVED_DHCP_END_OCTET:-250}}"
+
+AP_CIDR="$FALLBACK_AP_CIDR"
+AP_NETWORK_BASE="${AP_CIDR%%/*}"   # e.g. "10.10.10.1" out of "10.10.10.1/24"
+AP_NETWORK_BASE="${AP_NETWORK_BASE%.*}" # e.g. "10.10.10"
+DHCP_START="${AP_NETWORK_BASE}.${FALLBACK_AP_DHCP_START_OCTET}"
+DHCP_END="${AP_NETWORK_BASE}.${FALLBACK_AP_DHCP_END_OCTET}"
 
 # How often, while the AP has no clients, to stop the AP and give
 # NetworkManager a chance to reconnect to a known Wi-Fi network.
@@ -276,6 +301,24 @@ attempt_recovery() {
 }
 
 
+save_config() {
+    mkdir -p "$(dirname "$CONFIG_FILE")"
+
+    cat > "$CONFIG_FILE" <<EOF
+SAVED_IFACE="$WLAN0_IFACE"
+SAVED_SSID="$AP_NAME"
+SAVED_PASSWORD="$AP_PASSWORD"
+SAVED_ENCRYPTION="$AP_ENCRYPTION"
+SAVED_CIDR="$FALLBACK_AP_CIDR"
+SAVED_DHCP_START_OCTET="$FALLBACK_AP_DHCP_START_OCTET"
+SAVED_DHCP_END_OCTET="$FALLBACK_AP_DHCP_END_OCTET"
+EOF
+
+    # Contains the AP passphrase - keep it out of reach of other users.
+    chmod 600 "$CONFIG_FILE"
+}
+
+
 install() {
     if [ "$EUID" -ne 0 ]; then
         echo "Run this script as root."
@@ -297,6 +340,7 @@ install() {
     fi
 
     create_connection
+    save_config
 
     log "Creating recovery service"
 
@@ -324,6 +368,7 @@ EOF
 
     log "Installation complete"
     log "Script: $SCRIPT_PATH"
+    log "Config file: $CONFIG_FILE"
     log "SSID: $AP_NAME"
     log "Interface: $WLAN0_IFACE"
     log "Network: $AP_CIDR"
@@ -411,6 +456,7 @@ uninstall() {
     nmcli connection delete "$CONNECTION_NAME" >/dev/null 2>&1 || true
 
     rm -f "$SERVICE_FILE"
+    rm -f "$CONFIG_FILE"
     rm -rf "$STATE_DIR"
 
     systemctl daemon-reload
@@ -460,6 +506,13 @@ status() {
     echo "=== Fallback AP ==="
     nmcli connection show "$CONNECTION_NAME" 2>/dev/null || echo "Not installed"
 
+    echo
+    echo "=== Config ($CONFIG_FILE) ==="
+    echo "SSID: $AP_NAME"
+    echo "Interface: $WLAN0_IFACE"
+    echo "Network: $AP_CIDR"
+    echo "DHCP: $DHCP_START - $DHCP_END"
+
     echo
     echo "=== Last Known Wi-Fi ==="
     get_last_wifi || echo "None"
diff --git a/install.sh b/install.sh
index 92572f0..8a873a9 100644
--- a/install.sh
+++ b/install.sh
@@ -11,10 +11,24 @@ if [ "$EUID" -ne 0 ]; then
     exit 1
 fi
 
-echo "Downloading..."
+prompt() {
+    local __var="$1" __question="$2" __default="$3" __answer=""
+    if [ -e /dev/tty ]; then
+        read -r -p "$__question [$__default]: " __answer 2>/dev/null < /dev/tty > /dev/tty || __answer=""
+    fi
+    printf -v "$__var" '%s' "${__answer:-$__default}"
+}
+
+[ -z "${FALLBACK_AP_SSID:-}" ]              && prompt FALLBACK_AP_SSID "Access point SSID" "$(hostname)"
+[ -z "${FALLBACK_AP_PASSWORD:-}" ]          && prompt FALLBACK_AP_PASSWORD "Access point passphrase" "guesswhatitis"
+[ -z "${FALLBACK_AP_CIDR:-}" ]              && prompt FALLBACK_AP_CIDR "Access point subnet (CIDR)" "10.10.10.1/24"
+[ -z "${FALLBACK_AP_DHCP_START_OCTET:-}" ]  && prompt FALLBACK_AP_DHCP_START_OCTET "DHCP range start (last octet)" "100"
+[ -z "${FALLBACK_AP_DHCP_END_OCTET:-}" ]    && prompt FALLBACK_AP_DHCP_END_OCTET "DHCP range end (last octet)" "250"
+
+export FALLBACK_AP_SSID FALLBACK_AP_PASSWORD FALLBACK_AP_CIDR FALLBACK_AP_DHCP_START_OCTET FALLBACK_AP_DHCP_END_OCTET
+
+echo "Downloading fallback-ap..."
 curl -fsSL "$SCRIPT_URL" -o "$INSTALL_PATH"
-
 chmod +x "$INSTALL_PATH"
-
 echo "Running installer..."
-"$INSTALL_PATH" install
\ No newline at end of file
+"$INSTALL_PATH" install