diff --git a/docs/admin/server-setup.md b/docs/admin/server-setup.md
index b9e3f89..773c09c 100644
--- a/docs/admin/server-setup.md
+++ b/docs/admin/server-setup.md
@@ -1238,9 +1238,12 @@ Get a fresh registration token for each batch from **GitHub → Settings → Act
 ```bash
 coder users create --email ci@staging-coder.ddev.com --username ci-bot --login-type none
 coder users edit-roles ci-bot --roles template-admin --yes
+coder organizations members edit-roles ci-bot organization-template-admin
 coder tokens create --user ci-bot --lifetime 8760h
 ```
 
+The site-wide `template-admin` role lets `ci-bot` push templates and create workspaces. The org role `organization-template-admin` is also needed, so that `ci-bot` can read provisioner jobs. When `coder create` fails in the server-side Terraform step, the CLI often prints only `initialize terraform: exit status 1`. The workflows' "Show provisioner errors if workspace creation failed" step (`scripts/ci-show-provisioner-errors.sh`) then fetches the failed job's logs to show the real Terraform error. Without this role, that step can only print a warning.
+
 Store the token in 1Password at `op://test-secrets/TEST_CODER_SESSION_TOKEN/credential`.
 
 #### 3. Push the `ci-lock` template
diff --git a/openspec/changes/add-user-startup-hook/tasks.md b/openspec/changes/add-user-startup-hook/tasks.md
index 2142a29..eab0c40 100644
--- a/openspec/changes/add-user-startup-hook/tasks.md
+++ b/openspec/changes/add-user-startup-hook/tasks.md
@@ -6,7 +6,8 @@
 ## 2. Validation
 - [x] 2.1 `terraform fmt -check -recursive`, `make validate` and `make test-templates` pass <!-- id: 2.1 -->
 - [x] 2.2 Integration test: `freeform/scripts/test-freeform-startup-hook.sh` installs a hook before the GH freeform job's workspace restart and verifies it after <!-- id: 2.2 -->
-- [ ] 2.3 Integration test passes on staging <!-- id: 2.3 -->
+- [x] 2.3 Integration test passes on staging <!-- id: 2.3 -->
+- [x] 2.4 Manual check on staging: a `~/.coder-startup.sh` that starts a Claude self-hosted runner in tmux brings the runner up after a workspace restart with no terminal open, and a session lands on it <!-- id: 2.4 -->
 
 ## 3. Image
 - [x] 3.1 Install `claude-code@latest` instead of `claude-code` in `image/Dockerfile` (VERSION unchanged) <!-- id: 3.1 -->