diff --git a/docs/SETUP.md b/docs/SETUP.md
index f260f5b..50e9426 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -61,7 +61,7 @@ It runs five steps in order:
 4. **secrets**: pushes `AUR_SSH_KEY`, `AUR_GIT_NAME`, `AUR_GIT_EMAIL` and, with GPG, `GPG_SIGNING_KEY` to your GitHub repo. It checks the SSH key as the ssh step does, so a key that is missing or has a passphrase stops it before any secret is set.
 5. **verify**: checks identity, SSH access to the AUR, GPG signing and the secrets
 
-The script reads the GitHub repo from the `origin` remote and asks for `owner/repo` when that fails. It saves your answers to `.aurtomator.conf`, also when `verify` finds a problem.
+The script reads the GitHub repo from the `origin` remote and asks for `owner/repo` when that fails. It saves your answers to `.aurtomator.conf` after each step, so a step that fails, and a `verify` that finds a problem, leave the answers given so far for the next run.
 
 ## Identity
 
diff --git a/scripts/setup.sh b/scripts/setup.sh
index d564238..78b261d 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -93,7 +93,6 @@ save_config() {
     printf 'GPG_KEY_ID=%s\n' "${GPG_KEY_ID@Q}"
     printf 'AUR_SSH_KEY=%s\n' "${AUR_SSH_KEY@Q}"
   } >"$CONFIG_FILE"
-  ok "Config saved to .aurtomator.conf"
 }
 
 # =============================================================================
@@ -567,13 +566,9 @@ fi
 
 printf "%saurtomator setup%s\n" "$BOLD" "$RESET"
 
-FULL_SETUP=false
-if [[ ${#STEPS[@]} -eq 5 ]]; then
-  FULL_SETUP=true
-fi
-
-# A failed verify still saves the config, so the re-run it suggests has
-# the values of this run
+# Each step is saved as soon as it ends, so a step that fails keeps the
+# answers given before it. A failed verify still saves the config, so the
+# re-run it suggests has the values of this run.
 EXIT_STATUS=0
 for step in "${STEPS[@]}"; do
   case "$step" in
@@ -583,12 +578,7 @@ for step in "${STEPS[@]}"; do
     secrets) setup_secrets ;;
     verify) verify_all || EXIT_STATUS=1 ;;
   esac
-  if [[ "$FULL_SETUP" == "false" ]]; then
-    save_config
-  fi
-done
-
-if [[ "$FULL_SETUP" == "true" ]]; then
   save_config
-fi
+done
+ok "Config saved to .aurtomator.conf"
 exit "$EXIT_STATUS"
diff --git a/tests/setup.bats b/tests/setup.bats
index bb8aab7..d78a799 100644
--- a/tests/setup.bats
+++ b/tests/setup.bats
@@ -363,7 +363,9 @@ EOF
 # === Config persistence ===
 
 @test "setup: saves config file" {
-  "$TEST_TMPDIR/scripts/setup.sh" gpg --gpg-key VALIDKEY123 --non-interactive 2>/dev/null
+  run "$TEST_TMPDIR/scripts/setup.sh" gpg --gpg-key VALIDKEY123 --non-interactive
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Config saved to .aurtomator.conf"* ]]
   [ -f "$TEST_TMPDIR/.aurtomator.conf" ]
   grep -q "VALIDKEY123" "$TEST_TMPDIR/.aurtomator.conf"
 }
@@ -504,6 +506,19 @@ EOF
   grep -qx "AUR_SSH_KEY='$TEST_TMPDIR/ssh/aur.pem'" "$TEST_TMPDIR/.aurtomator.conf"
 }
 
+# A full setup runs every step in one go, and a step that fails ends it
+@test "setup: full setup keeps the identity when the ssh step fails" {
+  mkdir -p "$TEST_TMPDIR/ssh-pass"
+  ssh-keygen -t ed25519 -f "$TEST_TMPDIR/ssh-pass/key" -N "testpass" -q
+
+  run "$TEST_TMPDIR/scripts/setup.sh" \
+    --git-name "Jane Doe" --git-email "jane@example.com" \
+    --ssh-key "$TEST_TMPDIR/ssh-pass/key" --non-interactive
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"SSH key has a passphrase"* ]]
+  grep -qx "GIT_AUTHOR_NAME='Jane Doe'" "$TEST_TMPDIR/.aurtomator.conf"
+}
+
 # === Secrets step ===
 
 @test "setup secrets: sets all secrets via gh" {