diff --git a/.gitea/workflows/build-publish.yml b/.gitea/workflows/build-publish.yml
index 462ea5d..497990c 100644
--- a/.gitea/workflows/build-publish.yml
+++ b/.gitea/workflows/build-publish.yml
@@ -105,8 +105,9 @@ jobs:
               #                admin configs survive the migration off dpkg
               #                tracking).
               #     postinst — restores that backup, then seeds any MISSING
-              #                /nginx default after asking the admin (Y/N per
-              #                file); existing configs are never replaced.
+              #                /nginx default: silently on a fresh install,
+              #                after asking the admin (Y/N per file) on an
+              #                upgrade; existing configs are never replaced.
               #   twiy-raweb:
               #     preinst/postinst — NEVER touch /nginx (no create, update,
               #                replace, remove, or chown). Only the binary,
diff --git a/build/deb/postinst b/build/deb/postinst
index b02d1e4..e7a5e24 100755
--- a/build/deb/postinst
+++ b/build/deb/postinst
@@ -7,11 +7,24 @@
 #
 # Config policy for twiy:
 #   - target present (identical OR admin-edited) -> NEVER replace; leave as-is.
-#   - target absent                             -> ASK the admin (per file,
-#                                                  Y/N) and only create it on Y.
+#   - target absent, FRESH INSTALL               -> create it, no questions.
+#                                                  /nginx is empty by design on
+#                                                  a fresh install, so asking
+#                                                  would mean one Y/N per file
+#                                                  and a noninteractive install
+#                                                  would end up with no config
+#                                                  at all (nginx then fails to
+#                                                  start).
+#   - target absent, UPGRADE                     -> the admin deleted it on
+#                                                  purpose, so ASK (per file,
+#                                                  Y/N) and only create on Y.
 # We never drop <file>.new and we never overwrite an existing config, so an
 # upgrade can never change an admin-edited config.
 #
+# TWIY_SEED_DEFAULTS overrides the upgrade behaviour for automation:
+#   yes -> create every missing default without asking
+#   no  -> never create a missing default
+#
 # /hostdata is left entirely to the admin: we only make sure the dir exists,
 # and we never touch or remove its contents.
 
@@ -34,6 +47,15 @@ prompt_yes_no() {
     esac
 }
 
+# dpkg calls us as `postinst configure <old-version>`; $2 is empty only on a
+# fresh install (or on reinstall after a purge), which is exactly the case where
+# an empty /nginx is expected rather than admin intent.
+if [ "$1" = configure ] && [ -z "${2:-}" ]; then
+    fresh_install=yes
+else
+    fresh_install=no
+fi
+
 useradd -r -s /bin/false nginx 2>/dev/null || true
 
 # Existing dirs are left exactly as they are (mkdir -p is a no-op then).
@@ -49,9 +71,21 @@ if [ -d /var/backups/twiy-nginx ]; then
     rm -rf /var/backups/twiy-nginx
 fi
 
+# Should a missing config be created? Fresh install and TWIY_SEED_DEFAULTS
+# answer without touching the terminal; an upgrade asks the admin per file.
+seed_missing() {
+    dst="$1"
+    case "${TWIY_SEED_DEFAULTS:-}" in
+        [Yy]|[Yy][Ee][Ss]) return 0 ;;
+        [Nn]|[Nn][Oo])     return 1 ;;
+    esac
+    [ "$fresh_install" = yes ] && return 0
+    prompt_yes_no "config '$dst' does not exist. Create it from the packaged default?"
+}
+
 # Seed packaged defaults:
 #   - target present  -> do nothing (never replace, no .new).
-#   - target absent   -> ask the admin; create it only if they answer yes.
+#   - target absent   -> seed_missing decides (see the policy note above).
 seed_tree() {
     stash="$1"
     target="$2"
@@ -62,7 +96,7 @@ seed_tree() {
         if [ -e "$dst" ]; then
             continue
         fi
-        if prompt_yes_no "config '$dst' does not exist. Create it from the packaged default?"; then
+        if seed_missing "$dst"; then
             install -d "$(dirname "$dst")"
             cp -p "$src" "$dst"
             echo "twiy: created $dst"