diff --git a/scripts/checks/requirements/check_install_type.sh b/scripts/checks/requirements/check_install_type.sh
index d821ae8..3f88ce5 100755
--- a/scripts/checks/requirements/check_install_type.sh
+++ b/scripts/checks/requirements/check_install_type.sh
@@ -1,20 +1,35 @@
 #!/bin/bash
 
+# Resolves the system user that owns the Docker install — and therefore the
+# backup repos and container files. Rooted installs run as $sudo_user_name;
+# rootless installs use $CFG_DOCKER_INSTALL_USER. Falls back to $sudo_user_name
+# and finally 'libreportal' so the value is never empty: an empty user turns
+# `sudo -u "$docker_install_user"` into a sudo usage error. Reads only config,
+# so it is safe to call from any CLI entry point.
+resolveDockerInstallUser()
+{
+	if [[ "$CFG_DOCKER_INSTALL_TYPE" == "rootless" ]]; then
+		docker_install_user="$CFG_DOCKER_INSTALL_USER"
+	else
+		docker_install_user="$sudo_user_name"
+	fi
+	[[ -z "$docker_install_user" ]] && docker_install_user="$sudo_user_name"
+	[[ -z "$docker_install_user" ]] && docker_install_user="libreportal"
+}
+
 checkInstallTypeRequirement()
-{  
+{
 	if [[ "$OS_TYPE" == "Ubuntu" || "$OS_TYPE" == "Debian" ]]; then
 		ISCOMP=$( (docker compose -v ) 2>&1 )
 		ISUFW=$( (sudo ufw status ) 2>&1 )
 		ISUFWD=$( (sudo ufw-docker) 2>&1 )
 
+		resolveDockerInstallUser
+
 		if [[ $CFG_DOCKER_INSTALL_TYPE == "rooted" ]]; then
-			# Docker Type username
-        	docker_install_user="$sudo_user_name"
 			# Used for checking if rooted docket is active
 			ISACT=$( (sudo systemctl is-active docker ) 2>&1 )
 		elif [[ $CFG_DOCKER_INSTALL_TYPE == "rootless" ]]; then
-			# Docker Type username
-		    docker_install_user="$CFG_DOCKER_INSTALL_USER"
 			# Used for checking the rootless user
 			local ISUSER=$( (sudo id -u "$CFG_DOCKER_INSTALL_USER"))
 			if [[ "$ISUSER" == *"no such user"* ]]; then
@@ -22,4 +37,4 @@ checkInstallTypeRequirement()
 			fi
 		fi
 	fi
-} 
\ No newline at end of file
+}
\ No newline at end of file
diff --git a/scripts/cli/cli_initialize.sh b/scripts/cli/cli_initialize.sh
index 5db1564..3b02511 100755
--- a/scripts/cli/cli_initialize.sh
+++ b/scripts/cli/cli_initialize.sh
@@ -1,9 +1,16 @@
 #!/bin/bash
 
-cliInitialize() 
+cliInitialize()
 {
     cliUpdateCommands;
 
+    # Many commands shell out via `sudo -u "$docker_install_user"` (backup
+    # engines, permission fixes, file copies). Resolve it up front so commands
+    # run from the WebUI — e.g. `setup finalize`, `backup` — get a valid user
+    # instead of an empty one. The app category still runs the fuller
+    # checkInstallTypeRequirement below.
+    resolveDockerInstallUser;
+
     # Dynamic routing - auto-discover ALL categories!
     local category="$initial_command1"