diff --git a/apps/docs/content/guides/self-hosting/docker.mdx b/apps/docs/content/guides/self-hosting/docker.mdx
index 5c1b8dc142f..49cdb9a06bf 100644
--- a/apps/docs/content/guides/self-hosting/docker.mdx
+++ b/apps/docs/content/guides/self-hosting/docker.mdx
@@ -87,6 +87,8 @@ The script supports Linux only (Debian/Ubuntu and RHEL/CentOS/Fedora) and will:
 
 The shortened link points to [setup.sh](https://raw.githubusercontent.com/supabase/supabase/refs/heads/master/docker/setup.sh) - you can inspect it before running. Use `-y` to run non-interactively with default values.
 
+When the script installs Docker for you, it also adds the user to the `docker` group. Log out and back in before continuing, otherwise the `docker` commands below need `sudo`.
+
 After the script finishes, start the stack:
 
 ```sh
diff --git a/docker/setup.sh b/docker/setup.sh
index 605f0fc8f17..007d0c24647 100755
--- a/docker/setup.sh
+++ b/docker/setup.sh
@@ -219,6 +219,11 @@ install_docker() {
     log "Enabling and starting docker service"
     $SUDO systemctl enable --now docker || warn "Could not enable docker via systemctl; start it manually."
 
+    # Only relevant when a non-root user just installed Docker (requires re-login).
+    if [ -n "$SUDO" ]; then
+        $SUDO usermod -aG docker "$(id -un)" || warn "Could not add $(id -un) to the docker group; run docker with sudo or add it manually."
+    fi
+
     docker_present || die "Docker installation finished but 'docker compose' is still unavailable."
 }
 
@@ -359,6 +364,13 @@ if [ "$WITH_AWS" = "1" ]; then
     install_aws
 fi
 
+# A user added to the docker group above cannot use it until the next login.
+DOCKER="docker"
+if [ -n "$SUDO" ] && ! docker info >/dev/null 2>&1; then
+    DOCKER="$SUDO docker"
+fi
+export DOCKER
+
 # Idempotent re-run: if CWD is already a set-up project, skip bootstrap.
 # A clone has docker-compose.yml + utils/ but only .env.example;
 # a set-up project also has a real .env.
@@ -436,14 +448,18 @@ write_version_stamp "$RESOLVED_REF"
 
 log "Pulling Docker images"
 if [ "$NON_INTERACTIVE" = "1" ]; then
-    docker compose --progress quiet pull || warn "docker compose pull failed; you can retry later."
+    $DOCKER compose --progress quiet pull || warn "docker compose pull failed; you can retry later."
 else
-    docker compose pull || warn "docker compose pull failed; you can retry later."
+    $DOCKER compose pull || warn "docker compose pull failed; you can retry later."
 fi
 
 echo ""
 echo "Setup complete. Project ready at: $(pwd)"
 echo ""
+if [ "$DOCKER" != "docker" ]; then
+    echo "Re-log in to pick up the docker group before the next steps, or use sudo."
+    echo ""
+fi
 echo "Next steps:"
 echo "  cd $(pwd)"
 echo "  sh run.sh config"
diff --git a/docker/utils/add-new-auth-keys.sh b/docker/utils/add-new-auth-keys.sh
index 3073ca76365..f921b6e876a 100644
--- a/docker/utils/add-new-auth-keys.sh
+++ b/docker/utils/add-new-auth-keys.sh
@@ -38,17 +38,17 @@ else
         exit 1
     fi
 
-    if ! docker info >/dev/null 2>&1; then
-        echo "Error: docker is installed but the daemon is not running."
+    if ! ${DOCKER:-docker} info >/dev/null; then
+        echo "Error: cannot connect to the Docker daemon."
         exit 1
     fi
 
-    if ! docker image inspect node:22-alpine >/dev/null 2>&1; then
+    if ! ${DOCKER:-docker} image inspect node:22-alpine >/dev/null 2>&1; then
         echo "Pulling node:22-alpine (first-run only)..."
-        docker pull node:22-alpine
+        ${DOCKER:-docker} pull node:22-alpine
     fi
 
-    node_runner="docker run --rm node:22-alpine node"
+    node_runner="${DOCKER:-docker} run --rm node:22-alpine node"
 fi
 
 # Read JWT_SECRET from .env
diff --git a/docker/utils/rotate-new-api-keys.sh b/docker/utils/rotate-new-api-keys.sh
index 48fd9f02db8..7ab951670ad 100644
--- a/docker/utils/rotate-new-api-keys.sh
+++ b/docker/utils/rotate-new-api-keys.sh
@@ -36,17 +36,17 @@ else
         exit 1
     fi
 
-    if ! docker info >/dev/null 2>&1; then
-        echo "Error: docker is installed but the daemon is not running."
+    if ! ${DOCKER:-docker} info >/dev/null; then
+        echo "Error: cannot connect to the Docker daemon."
         exit 1
     fi
 
-    if ! docker image inspect node:22-alpine >/dev/null 2>&1; then
+    if ! ${DOCKER:-docker} image inspect node:22-alpine >/dev/null 2>&1; then
         echo "Pulling node:22-alpine (first-run only)..."
-        docker pull node:22-alpine
+        ${DOCKER:-docker} pull node:22-alpine
     fi
 
-    node_runner="docker run --rm node:22-alpine node"
+    node_runner="${DOCKER:-docker} run --rm node:22-alpine node"
 fi
 
 if [ ! -f .env ]; then