diff --git a/kanidm-setup.sh b/kanidm-setup.sh
index ce3c922..49a2848 100755
--- a/kanidm-setup.sh
+++ b/kanidm-setup.sh
@@ -12,7 +12,9 @@ cd "$(dirname "$0")"
 K="kanidm -D idm_admin -H https://$ID_HOST"
 C=$OAUTH2_CLIENT_ID
 
-$K login
+# Already signed in? Then do not ask again: this script is meant to be
+# rerunnable, and the session outlives a single run.
+$K self whoami >/dev/null 2>&1 || $K login
 has_client() { $K system oauth2 get "$1" 2>/dev/null | grep -q '^name:'; }
 has_group() { $K group get "$1" 2>/dev/null | grep -q '^name:'; }