diff --git a/install-stack.sh b/install-stack.sh
index 0fb5049..2e109dc 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -254,6 +254,7 @@ gen_secrets() {
     CENTRAL_AUTH_SECRET=$(sed -n 's/^CENTRAL_AUTH_SECRET=//p' "$CREDS_FILE" | head -1)
     SETTINGS_SECRET=$(sed -n 's/^SETTINGS_SECRET=//p' "$CREDS_FILE" | head -1)
     WEBHOOK_SECRET=$(sed -n 's/^WEBHOOK_SECRET=//p' "$CREDS_FILE" | head -1)
+    NPM_ADMIN_EMAIL=$(sed -n 's/^NPM_ADMIN_EMAIL=//p' "$CREDS_FILE" | head -1)
     NPM_ADMIN_PASS=$(sed -n 's/^NPM_ADMIN_PASS=//p' "$CREDS_FILE" | head -1)
     msg_ok "Reusing existing secrets"
     return
@@ -289,7 +290,7 @@ CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
 SETTINGS_SECRET=${SETTINGS_SECRET}
 WEBHOOK_SECRET=${WEBHOOK_SECRET}
 
-NPM_ADMIN_EMAIL=admin@${DOMAIN}
+NPM_ADMIN_EMAIL=manage@hotel.com
 NPM_ADMIN_PASS=${NPM_ADMIN_PASS}
 
 FORGEJO_BASE=${FORGEJO_BASE}
@@ -907,11 +908,71 @@ ${build_out}"
   wait_healthy 117 "http://localhost:3083/cashup/api/health" \
     && msg_ok "Cashup running at 10.10.10.117:3083" \
     || msg_warn "Cashup may need extra time — check LXC 117"
+
+  # Add /cashup/ location to the existing NPM proxy host (idempotent)
+  msg_info "Adding /cashup/ to NPM proxy"
+  local npm_token
+  npm_token=$(npm_get_token)
+
+  if [[ -n "$npm_token" ]]; then
+    # Find the proxy host for our domain
+    local host_id
+    host_id=$(curl -sf "http://${NPM_LAN_IP}:81/api/nginx/proxy-hosts" \
+      -H "Authorization: Bearer ${npm_token}" 2>/dev/null \
+      | grep -o '"id":[0-9]*,"domain_names":\["'"${DOMAIN}"'"\]' \
+      | grep -o '"id":[0-9]*' | cut -d: -f2) || true
+
+    if [[ -n "$host_id" ]]; then
+      # Fetch existing host, merge /cashup/ location, PUT back
+      local existing
+      existing=$(curl -sf "http://${NPM_LAN_IP}:81/api/nginx/proxy-hosts/${host_id}" \
+        -H "Authorization: Bearer ${npm_token}" 2>/dev/null) || true
+
+      if [[ -n "$existing" ]] && ! echo "$existing" | grep -q '"/cashup/"'; then
+        # Build merged locations by appending cashup entry
+        local merged_locations
+        merged_locations=$(echo "$existing" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+locs = d.get('locations') or []
+locs.append({'path':'/cashup/','forward_scheme':'http','forward_host':'10.10.10.117','forward_port':3083,'advanced_config':''})
+print(json.dumps(locs))
+" 2>/dev/null) || true
+
+        if [[ -n "$merged_locations" ]]; then
+          curl -sf -X PUT "http://${NPM_LAN_IP}:81/api/nginx/proxy-hosts/${host_id}" \
+            -H "Authorization: Bearer ${npm_token}" \
+            -H "Content-Type: application/json" \
+            -d "{\"locations\":${merged_locations}}" &>/dev/null \
+            && msg_ok "NPM location /cashup/ added" \
+            || msg_warn "NPM update failed — add /cashup/ → 10.10.10.117:3083 manually in NPM admin"
+        fi
+      else
+        msg_ok "NPM location /cashup/ already present"
+      fi
+    else
+      msg_warn "NPM proxy host for ${DOMAIN} not found — add /cashup/ → 10.10.10.117:3083 manually"
+    fi
+  else
+    msg_warn "NPM API unavailable — add /cashup/ → 10.10.10.117:3083 manually in NPM admin"
+  fi
 }
 
 # ════════════════════════════════════════════════════════════════════════════
 # NPM PROXY HOSTS (via API)
 # ════════════════════════════════════════════════════════════════════════════
+
+# Returns a Bearer token for the NPM API, or empty string on failure.
+npm_get_token() {
+  local email="${NPM_ADMIN_EMAIL:-manage@hotel.com}"
+  local pass="${NPM_ADMIN_PASS:-}"
+  [[ -z "$pass" ]] && { echo ""; return; }
+  curl -sf -X POST "http://${NPM_LAN_IP}:81/api/tokens" \
+    -H "Content-Type: application/json" \
+    -d "{\"identity\":\"${email}\",\"secret\":\"${pass}\"}" \
+    2>/dev/null | grep -o '"token":"[^"]*"' | cut -d'"' -f4 || echo ""
+}
+
 configure_npm_proxy_hosts() {
   msg_step "Configuring NPM proxy hosts"
   msg_info "Waiting for NPM API to be ready"
@@ -922,12 +983,8 @@ configure_npm_proxy_hosts() {
     [[ $i -ge 30 ]] && { msg_warn "NPM API not responding — configure proxy hosts manually"; return; }
   done
 
-  # Get token with default credentials
   local token
-  token=$(curl -sf -X POST "http://${NPM_LAN_IP}:81/api/tokens" \
-    -H "Content-Type: application/json" \
-    -d '{"identity":"admin@example.com","secret":"changeme"}' \
-    2>/dev/null | grep -o '"token":"[^"]*"' | cut -d'"' -f4) || true
+  token=$(npm_get_token)
 
   if [[ -z "$token" ]]; then
     msg_warn "Could not get NPM token — proxy hosts must be created manually (see summary)"
@@ -968,7 +1025,8 @@ configure_npm_proxy_hosts() {
   local locations='[
     {"path":"/api/auth/","forward_scheme":"http","forward_host":"10.10.10.101","forward_port":3001,"advanced_config":""},
     {"path":"/notices/","forward_scheme":"http","forward_host":"10.10.10.112","forward_port":3080,"advanced_config":""},
-    {"path":"/monitor/","forward_scheme":"http","forward_host":"10.10.10.105","forward_port":3002,"advanced_config":""}
+    {"path":"/monitor/","forward_scheme":"http","forward_host":"10.10.10.105","forward_port":3002,"advanced_config":""},
+    {"path":"/cashup/","forward_scheme":"http","forward_host":"10.10.10.117","forward_port":3083,"advanced_config":""}
   ]'
 
   local result; result=$(create_proxy_host "10.10.10.102" 3000 "$locations")