diff --git a/tests/scripts/setup_env_test.sh b/tests/scripts/setup_env_test.sh
index d5f4bd2..b28eb8e 100644
--- a/tests/scripts/setup_env_test.sh
+++ b/tests/scripts/setup_env_test.sh
@@ -102,11 +102,22 @@ test_hosts_beside_the_web_domain_share_its_parent_as_the_cookie_domain() {
 test_hosts_under_the_web_domain_leave_the_cookie_domain_alone() {
     make_panel
     set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
+    export FLAT_HOSTS=false
     run_setup_env
     assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=api.panel.example.com"
     assert_eq "$(env_lines overlays/config/api-config.env AUTH_COOKIE_DOMAIN)" ""
 }
 
+test_a_subdomain_puts_every_address_one_level_deep_by_default() {
+    make_panel
+    set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
+    run_setup_env
+    assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=panel-api.example.com"
+    assert_eq "$(env_lines overlays/config/typesense-config.env TYPESENSE_HOST)" "TYPESENSE_HOST=panel-search.example.com"
+    assert_eq "$(env_lines overlays/config/api-config.env AUTH_COOKIE_DOMAIN)" "AUTH_COOKIE_DOMAIN=.example.com"
+    assert_contains "$(cat "$WORK_DIR/setup-output")" "Sign-in then covers all of example.com, so other sites on example.com get the panel's sign-in cookie."
+}
+
 test_flat_hosts_put_every_address_one_level_deep_beside_the_panel() {
     make_panel
     set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
@@ -134,14 +145,15 @@ test_the_free_cloudflare_plan_puts_every_address_one_level_deep_and_says_so() {
     assert_contains "$(cat "$WORK_DIR/setup-output")" "Other sites on example.com will receive the panel's sign-in cookie."
 }
 
-test_a_paid_cloudflare_plan_keeps_every_address_under_the_panel() {
+test_a_paid_cloudflare_plan_keeps_the_default_without_the_free_plan_alert() {
     make_panel
     sed -i.bak 's/^CLOUDFLARE=false$/CLOUDFLARE=true/' "$PANEL/.5stack-env.config"
     set_env overlays/config/api-config.env WEB_DOMAIN panel.example.com
     export CLOUDFLARE_PLAN=paid
     run_setup_env
-    assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=api.panel.example.com"
-    assert_not_contains "$(cat "$WORK_DIR/setup-output")" "sign-in cookie"
+    assert_eq "$(env_lines overlays/config/api-config.env API_DOMAIN)" "API_DOMAIN=panel-api.example.com"
+    assert_not_contains "$(cat "$WORK_DIR/setup-output")" "Cloudflare's free plan"
+    assert_contains "$(cat "$WORK_DIR/setup-output")" "Sign-in then covers all of example.com"
 }
 
 test_a_root_domain_keeps_its_addresses_under_it() {
diff --git a/utils/setup-env.sh b/utils/setup-env.sh
index 64bc1b4..e17828f 100755
--- a/utils/setup-env.sh
+++ b/utils/setup-env.sh
@@ -98,9 +98,15 @@ if [ "$DEBUG" = true ]; then
 fi
 
 ask_yes_no() {
-    local prompt="$1" answer
+    local prompt="$1" default="${2:-}" answer hint="y/n"
+    if [ "$default" = y ]; then
+        hint="Y/n"
+    fi
     while true; do
-        read -p "$prompt (y/n): " answer
+        read -p "$prompt ($hint): " answer
+        if [ -z "$answer" ]; then
+            answer="$default"
+        fi
         if [ "$answer" = "y" ] || [ "$answer" = "n" ]; then
             break
         fi
@@ -198,27 +204,20 @@ ask_flat_hosts() {
     if [ "$ASSUME_YES" = true ] || [ ! -t 0 ]; then
         interactive=false
     fi
-    FLAT_HOSTS=false
-    if [ "$CLOUDFLARE" = true ]; then
-        if [ -z "$CLOUDFLARE_PLAN" ] && [ "$interactive" = true ]; then
-            ask_cloudflare_plan
-        fi
-        if [ "$CLOUDFLARE_PLAN" != free ]; then
-            return
-        fi
-        FLAT_HOSTS=true
-        flat_hosts_alert
-        if [ "$interactive" = true ] && ! ask_yes_no "Keep every address one level deep? n keeps them under the panel, straight to this server"; then
-            FLAT_HOSTS=false
-        fi
-        return
+    FLAT_HOSTS=true
+    if [ "$CLOUDFLARE" = true ] && [ -z "$CLOUDFLARE_PLAN" ] && [ "$interactive" = true ]; then
+        ask_cloudflare_plan
     fi
-    if [ "$interactive" != true ]; then
-        return
+    local question
+    question="Keep every address one level deep ($(flat_host api) instead of api.$WEB_DOMAIN)?"
+    if [ "$CLOUDFLARE" = true ] && [ "$CLOUDFLARE_PLAN" = free ]; then
+        flat_hosts_alert
+        question="Keep every address one level deep? Recommended on Cloudflare's free plan; n keeps them under the panel, straight to this server"
+    else
+        echo "Sign-in then covers all of $parent, so other sites on $parent get the panel's sign-in cookie."
     fi
-    echo "Sign-in then covers all of $parent, so other sites on $parent get the panel's sign-in cookie."
-    if ask_yes_no "Keep every address one level deep ($(flat_host api) instead of api.$WEB_DOMAIN)?"; then
-        FLAT_HOSTS=true
+    if [ "$interactive" = true ] && ! ask_yes_no "$question" y; then
+        FLAT_HOSTS=false
     fi
 }