diff --git a/install-stack.sh b/install-stack.sh
index 59bfc91..d60760b 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -61,21 +61,47 @@ STORAGE=$(detect_storage)
 
 # ── Check vmbr1 internal bridge ───────────────────────────────────────────────
 check_vmbr1() {
-  if ! ip link show vmbr1 &>/dev/null; then
-    whiptail --title "vmbr1 Missing" --msgbox \
-"The internal container bridge vmbr1 does not exist yet.
+  ip link show vmbr1 &>/dev/null && return   # already present
 
-Add the following to /etc/network/interfaces on this host,
-then run:  ifreload -a
+  if whiptail --title "Create internal bridge vmbr1?" --yesno \
+"The internal container bridge vmbr1 (10.10.10.1/24) doesn't exist yet.
+
+Create it now?  This adds an ISOLATED bridge with no physical ports,
+so it cannot affect your LAN or vmbr0. It appends a stanza to
+/etc/network/interfaces and applies it with ifreload -a." 14 68; then
+
+    if grep -qE '^\s*iface\s+vmbr1' /etc/network/interfaces 2>/dev/null; then
+      msg_warn "vmbr1 already defined in /etc/network/interfaces — applying it"
+    else
+      cat >> /etc/network/interfaces <<'EOF'
+
+auto vmbr1
+iface vmbr1 inet static
+    address 10.10.10.1/24
+    bridge-ports none
+    bridge-stp off
+    bridge-fd 0
+EOF
+    fi
+    msg_info "Bringing up vmbr1"
+    ifreload -a &>/dev/null || systemctl restart networking &>/dev/null || true
+    sleep 2
+    if ip link show vmbr1 &>/dev/null; then
+      msg_ok "vmbr1 up (10.10.10.1/24)"
+    else
+      msg_error "vmbr1 still not up — check /etc/network/interfaces and re-run"
+    fi
+  else
+    whiptail --title "vmbr1 Missing" --msgbox \
+"Cancelled. Add this to /etc/network/interfaces, run 'ifreload -a',
+then re-run the installer:
 
   auto vmbr1
   iface vmbr1 inet static
       address  10.10.10.1/24
       bridge-ports none
       bridge-stp off
-      bridge-fd 0
-
-Then re-run this installer." 18 62
+      bridge-fd 0" 16 66
     exit 1
   fi
 }