diff --git a/README.md b/README.md
index a9cb10a..804d349 100644
--- a/README.md
+++ b/README.md
@@ -131,3 +131,29 @@ to send from and says so in its log.
 Replies are not read yet: `JMAP_URL`, `JMAP_TOKEN` and `MAIL_REPLY_DOMAIN`
 turn a reply into a note on the record it answers, and none of them are set
 here.
+
+## How the login page looks
+
+Out of the box Kanidm presents itself: its own name, its own mark. A
+neighbour arriving at a login page that belongs to nobody in particular
+is right to hesitate, so `kanidm-setup.sh` sets the vel's name and mark
+on both the instance and the portal client:
+
+```sh
+kanidm -D idm_admin -H https://$ID_HOST system domain set-displayname "Tomter Vel"
+kanidm -D idm_admin -H https://$ID_HOST system domain set-image logo.svg svg
+```
+
+The logo is fetched from the content repo - the same `images/logo.svg`
+that `site.yaml` uses as the favicon - so the login page and the site
+are branded from one place. png, jpg, gif, svg and webp all work.
+
+Two things the setup script deliberately leaves alone, because they are
+decisions rather than branding:
+
+- `system domain set-allow-account-recovery true` lets someone who has
+  lost their credentials get a reset link by proving one of their own
+  email addresses, instead of asking the board. Worth having for a vel;
+  it is still a door, so it is turned on knowingly or not at all.
+- `system domain set-allow-easter-eggs` - seasonal icons and birthday
+  surprises. Off in production builds, and this is somebody's vel.
diff --git a/kanidm-setup.sh b/kanidm-setup.sh
index 49a2848..5dcc747 100755
--- a/kanidm-setup.sh
+++ b/kanidm-setup.sh
@@ -36,6 +36,27 @@ for g in kasserer styret komiteer nabohjelp arrangementer elvesti horingsinstans
 done
 $K system oauth2 update-claim-map-join $C groups array
 
+# What a member sees when they land on the login page. Out of the box
+# Kanidm says "kanidm" and shows its own mark, which tells a neighbour
+# nothing about whose site they are signing in to - and a login page
+# that looks like it belongs to no one is the kind of thing people
+# rightly hesitate over.
+#
+# The logo comes from the content repo, because that is already where
+# this site's identity lives: the same file site.yaml uses as the
+# favicon. Branding follows the content, not this repo.
+$K system domain set-displayname "$SITE_NAME" || true
+$K system oauth2 set-displayname $C "$SITE_NAME" || true
+
+logo=$(mktemp --suffix=.svg)
+if curl -sfL "$CONTENT_REPO/raw/branch/$CONTENT_BRANCH/images/logo.svg" -o "$logo" && [ -s "$logo" ]; then
+  $K system domain set-image "$logo" svg || echo "note: could not set the instance logo"
+  $K system oauth2 set-image $C "$logo" svg || echo "note: could not set the client logo"
+else
+  echo "note: no images/logo.svg in the content repo - leaving the default mark"
+fi
+rm -f "$logo"
+
 secret=$($K system oauth2 show-basic-secret $C 2>/dev/null | tail -1)
 sed -i "s|^OAUTH2_CLIENT_SECRET=.*|OAUTH2_CLIENT_SECRET=$secret|" .env portal.env