diff --git a/SELF_HOSTING.md b/SELF_HOSTING.md
index 0d1a907..2feb36b 100644
--- a/SELF_HOSTING.md
+++ b/SELF_HOSTING.md
@@ -18,30 +18,50 @@ every gotcha below actually happened once and is now fixed or documented.
 
 ## 1. Install Docker
 
-**Check your actual distro first** — Docker has separate repos for Debian and Ubuntu,
-and mixing them up 404s:
-```bash
-cat /etc/os-release   # check ID (debian/ubuntu) and VERSION_CODENAME
-```
-
+This block auto-detects `debian` vs `ubuntu` from `/etc/os-release` **and** probes
+Docker's repo for your codename before adding it — if your codename is too new and 404s
+(interim/dev releases lag Docker's repo by months), it automatically falls back to the
+latest codename Docker actually publishes for your distro. No manual edits needed:
 ```bash
 sudo apt-get update
 sudo apt-get install -y ca-certificates curl gnupg
 sudo install -m 0755 -d /etc/apt/keyrings
-curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+
+. /etc/os-release
+DOCKER_DISTRO="$ID"                      # debian or ubuntu
+DOCKER_CODENAME="$VERSION_CODENAME"
+
+# Fallback list, newest first, per distro — used only if the detected codename 404s
+case "$DOCKER_DISTRO" in
+  ubuntu) FALLBACKS="noble jammy focal" ;;
+  debian) FALLBACKS="bookworm bullseye" ;;
+  *) echo "Unsupported distro '$DOCKER_DISTRO' — Docker only publishes debian/ubuntu repos." >&2; exit 1 ;;
+esac
+
+if ! curl -fsSL -o /dev/null "https://download.docker.com/linux/${DOCKER_DISTRO}/dists/${DOCKER_CODENAME}/Release"; then
+  echo "Docker has no repo for ${DOCKER_DISTRO} ${DOCKER_CODENAME} yet, falling back..." >&2
+  for fb in $FALLBACKS; do
+    if curl -fsSL -o /dev/null "https://download.docker.com/linux/${DOCKER_DISTRO}/dists/${fb}/Release"; then
+      DOCKER_CODENAME="$fb"
+      break
+    fi
+  done
+  echo "Using ${DOCKER_DISTRO} ${DOCKER_CODENAME}" >&2
+fi
+
+curl -fsSL "https://download.docker.com/linux/${DOCKER_DISTRO}/gpg" | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
 sudo chmod a+r /etc/apt/keyrings/docker.gpg
 
 echo \
-  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
-  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${DOCKER_DISTRO} \
+  ${DOCKER_CODENAME} stable" | \
   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
 
 sudo apt-get update
 sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
 ```
-(Swap `debian` → `ubuntu` in both URLs if you're actually on Ubuntu. If your codename is
-brand-new and Docker's repo 404s, fall back to the previous stable codename — e.g. use
-`bookworm` instead of `trixie`.)
+(The `FALLBACKS` lists above are current as of 2026-08 — bump them if Docker ships a
+newer stable codename by the time you read this.)
 
 Let your user run Docker without `sudo`:
 ```bash
@@ -182,7 +202,7 @@ machine.
 
 | Symptom | Cause | Fix |
 |---|---|---|
-| `apt` 404: `.../linux/ubuntu <codename> Release` not found | Docker repo added for the wrong distro (e.g. Ubuntu URL on a Debian box) | Match the URL to your real distro/codename from `/etc/os-release` |
+| `apt` 404: `.../linux/<distro> <codename> Release` not found | Step 1's install block already auto-detects and falls back — this only happens if you ran the old manual commands, or your codename is newer than every entry in `FALLBACKS` | Re-run Step 1's block as-is, or add your distro's actual latest stable codename to `FALLBACKS` |
 | `permission denied ... docker.sock` | User not in the `docker` group | `sudo usermod -aG docker $USER && newgrp docker` |
 | `WARN: "DB_NAME" variable is not set` (and similar) | Root `new_starr/.env` missing | Create it (see step 3) |
 | `postgres` container stuck `Restarting` | `POSTGRES_PASSWORD` blank (same root `.env` issue) | Same fix as above |