diff --git a/README.md b/README.md
index 96f11c2f7..b183ad9bc 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,19 @@ You need Docker Engine, the Compose plugin, curl, and OpenSSL. No clone or Node
 
 ```bash
 mkdir -p rakazo && cd rakazo &&
-curl -fsSLO https://raw.githubusercontent.com/elie222/rakazo/main/infra/compose/install-images.sh &&
+curl -fsSL -o install-images.sh https://raw.githubusercontent.com/elie222/rakazo/main/infra/compose/install-images.sh &&
+bash install-images.sh
+```
+
+If `raw.githubusercontent.com` is unreachable (Stage A), curl a HTTPS mirror of the same
+script instead — do not bake vendor CDN hostnames into defaults:
+
+```bash
+# Stage A + Stage B together when GitHub raw is unreachable:
+export RAKAZO_INSTALLER_URL=https://example.com/mirror/rakazo/infra/compose/install-images.sh
+export RAKAZO_DOWNLOAD_BASE=https://example.com/mirror/rakazo/infra/compose
+mkdir -p rakazo && cd rakazo &&
+curl -fsSL -o install-images.sh "${RAKAZO_INSTALLER_URL}" &&
 bash install-images.sh
 ```
 
@@ -59,9 +71,9 @@ with the matching API key.
 Default image tag is `edge` (main builds, `linux/amd64` + `linux/arm64`). Details and tags:
 [self-hosting guide](./docs/self-host.md#published-images-no-checkout).
 
-On restricted networks, override the installer download base (`RAKAZO_DOWNLOAD_BASE`), skip
-existing Compose files (`--local` / `RAKAZO_DOWNLOAD_SKIP_EXISTING`), or mirror the bootstrap
-script URL — see
+On restricted networks, also override the installer download base (`RAKAZO_DOWNLOAD_BASE`), skip
+existing Compose files (`--local` / `RAKAZO_DOWNLOAD_SKIP_EXISTING`), and/or Stage C image
+env vars — see
 [Restricted networks / mirror downloads](./docs/self-host.md#restricted-networks--mirror-downloads).
 
 For an agent-assisted install, use [SETUP_PROMPT.md](./SETUP_PROMPT.md).
diff --git a/SETUP_PROMPT.md b/SETUP_PROMPT.md
index ee88da12f..d786ddb2c 100644
--- a/SETUP_PROMPT.md
+++ b/SETUP_PROMPT.md
@@ -33,6 +33,11 @@ Preflight:
 
 - Verify Docker Engine and the Compose plugin are installed and the daemon is running.
 - Check whether `127.0.0.1` ports 3100 and 5173 are available.
+- Restricted / Mainland-style networks (optional but do this before Setup if pulls fail):
+  1. Stage A: can you `curl -fsSL --connect-timeout 5 --max-time 20 -o /dev/null` the installer URL? If not, set `RAKAZO_INSTALLER_URL` to your HTTPS mirror of `install-images.sh`.
+  2. Stage B: set `RAKAZO_DOWNLOAD_BASE` to a HTTPS mirror of `infra/compose`, or use `--local` / `RAKAZO_DOWNLOAD_SKIP_EXISTING=1` with files already on disk.
+  3. Stage C: if GHCR fails, set `RAKAZO_IMAGE` and `RAKAZO_COMPUTER_IMAGE` to registry/repository values **without** tags, and set `RAKAZO_IMAGE_TAG` / `RAKAZO_COMPUTER_IMAGE_TAG` explicitly (Compose appends those tags). If Hub fails for Postgres/busybox, set `POSTGRES_IMAGE` / `BUSYBOX_IMAGE` on a registry you control that serves the same `postgres:16` / `busybox:1` content — prefer digest pins when the mirror has them; verify the pulled digest before startup (or merge `infra/compose/docker-daemon.registry-mirrors.example.json` into daemon config, replacing the example URL). See docs/self-host.md (Restricted networks / mirror downloads).
+  Do not invent vendor-specific CDN hostnames.
 
 Setup:
 
diff --git a/infra/compose/docker-daemon.registry-mirrors.example.json b/infra/compose/docker-daemon.registry-mirrors.example.json
new file mode 100644
index 000000000..8690bc341
--- /dev/null
+++ b/infra/compose/docker-daemon.registry-mirrors.example.json
@@ -0,0 +1,3 @@
+{
+  "registry-mirrors": ["https://registry.example.com"]
+}