diff --git a/remote-access/mac-authorize.sh b/remote-access/mac-authorize.sh
index aac570c..8d10a8e 100644
--- a/remote-access/mac-authorize.sh
+++ b/remote-access/mac-authorize.sh
@@ -1,5 +1,5 @@
 # Paste this into Apple Remote Desktop: select the Macs -> Manage -> Send UNIX Command,
-# "Run command as: current user", then Send. It lets NA Ingest's status panel log in
-# with its key (no password), and prints this Mac's account name for the config.
-# Safe to run more than once.
-H=$(dscl . -read "/Users/$(whoami)" NFSHomeDirectory | awk '{print $2}'); mkdir -p "$H/.ssh" && chmod 700 "$H/.ssh" && touch "$H/.ssh/authorized_keys" && chmod 600 "$H/.ssh/authorized_keys" && (grep -q 'status-panel@NA-Ingest' "$H/.ssh/authorized_keys" || echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM2BPUpVpbMxKumLayVSutUsFWUXEfJ/4vxIJ0thbgY status-panel@NA-Ingest' >> "$H/.ssh/authorized_keys") && echo "OK user=$(whoami) mac=$(scutil --get ComputerName) ssh-group=$(dseditgroup -o checkmember -m "$(whoami)" com.apple.access_ssh 2>/dev/null | cut -d' ' -f1 || echo none)"
+# "Run command as: User: root" (or "Current user"), then Send. It lets NA Ingest's
+# status panel log in as whoever is logged in on that Mac, with its key (no password),
+# and prints that account name for the config. Safe to run more than once.
+U=$(stat -f%Su /dev/console); H=$(dscl . -read "/Users/$U" NFSHomeDirectory | awk '{print $2}'); mkdir -p "$H/.ssh" && touch "$H/.ssh/authorized_keys" && (grep -q 'status-panel@NA-Ingest' "$H/.ssh/authorized_keys" || echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM2BPUpVpbMxKumLayVSutUsFWUXEfJ/4vxIJ0thbgY status-panel@NA-Ingest' >> "$H/.ssh/authorized_keys") && chmod 700 "$H/.ssh" && chmod 600 "$H/.ssh/authorized_keys" && { [ "$(id -u)" != 0 ] || chown -R "$U:staff" "$H/.ssh"; } && echo "OK user=$U mac=$(scutil --get ComputerName) ssh-group=$(dseditgroup -o checkmember -m "$U" com.apple.access_ssh 2>/dev/null | cut -d' ' -f1)"