diff --git a/README.md b/README.md
index 07b487d..1988bde 100644
--- a/README.md
+++ b/README.md
@@ -50,19 +50,12 @@ The disadvantages are:
 Start the live CD of a supported Linux distribution, then open a terminal and execute:
 
 ```sh
-GET https://git.io/JelI5 | sudo bash -
+GET https://git.io/JelI5 | sudo bash
 ```
 
 then follow the instructions; halfway through the procedure, the GUI installer of the O/S will be launched.
 
-### Ubuntu Server
-
-Ubuntu Server requires a slightly different execution procedure:
-
-- when the installer welcome screen shows up, tap `Ctrl+Alt+F2`,
-- then type `sudo -- bash -c "$(curl -L https://git.io/JelI5)"`.
-
-the rest is the same as the generic procedure.
+In order to open a terminal on Ubuntu Server, tap `Ctrl+Alt+F2`.
 
 ### Unsupported systems/Issues
 
diff --git a/install-zfs.sh b/install-zfs.sh
index 2a36d6b..d05117f 100755
--- a/install-zfs.sh
+++ b/install-zfs.sh
@@ -19,10 +19,14 @@ v_linux_distribution=        # Debian, Ubuntu, ... WATCH OUT: not necessarily fr
 v_zfs_08_in_repository=      # 1=true, false otherwise (applies only to Ubuntu-based)
 
 # Variables set (indirectly) by the user
+#
+# The passphrase has a special workflow - it's sent to a named pipe (see create_passphrase_named_pipe()).
+# Also note that `ZFS_PASSPHRASE` considers the unset state (see help).
+# The same strategy can possibly be used for `v_root_passwd` (the difference being that is used
+# inside a jail); logging the ZFS commands is enough, for now.
 
 v_bpool_name=
 v_bpool_tweaks=              # array; see defaults below for format
-v_passphrase=                # the corresponding var (ZFS_PASSPHRASE) has special behavior (see below)
 v_root_password=             # Debian-only
 v_rpool_name=
 v_rpool_tweaks=              # array; see defaults below for format
@@ -44,10 +48,12 @@ c_installed_os_data_mount_dir=/target
 declare -A c_supported_linux_distributions=([Debian]=10 [Ubuntu]="18.04 20.04" [UbuntuServer]="18.04 20.04" [LinuxMint]=19 [elementary]=5.1)
 c_boot_partition_size=768M   # while 512M are enough for a few kernels, the Ubuntu updater complains after a couple
 c_temporary_volume_size=12G  # large enough; Debian, for example, takes ~8 GiB.
+c_passphrase_named_pipe=$(dirname "$(mktemp)")/zfs-installer.pp.fifo
 
 c_log_dir=$(dirname "$(mktemp)")/zfs-installer
 c_install_log=$c_log_dir/install.log
 c_os_information_log=$c_log_dir/os_information.log
+c_running_processes_log=$c_log_dir/running_processes.log
 c_disks_log=$c_log_dir/disks.log
 c_zfs_module_version_log=$c_log_dir/updated_module_versions.log
 
@@ -209,6 +215,7 @@ function store_os_distro_information {
 
   # Madness, in order not to force the user to invoke "sudo -E".
   # Assumes that the user runs exactly `sudo bash`; it's not a (current) concern if the user runs off specification.
+  # Not found when running via SSH - inspect the processes for finding this information.
   #
   perl -lne 'BEGIN { $/ = "\0" } print if /^XDG_CURRENT_DESKTOP=/' /proc/"$PPID"/environ >> "$c_os_information_log"
 }
@@ -219,6 +226,13 @@ function store_os_distro_information_Debian {
   echo "DEBIAN_VERSION=$(cat /etc/debian_version)" >> "$c_os_information_log"
 }
 
+# Simplest and most solid way to gather the desktop environment (!).
+# See note in store_os_distro_information().
+#
+function store_running_processes {
+  ps ax --forest > "$c_running_processes_log"
+}
+
 function check_prerequisites {
   print_step_info_header
 
@@ -368,6 +382,17 @@ function find_zfs_package_requirements_Debian {
   :
 }
 
+# By using a FIFO, we avoid having to hide statements like `echo $v_passphrase | zpoool create ...`
+# from the logs.
+#
+# The FIFO file is left in the filesystem after the script exits. It's not worth taking care of
+# removing it, since the environment is entirely ephemeral.
+#
+function create_passphrase_named_pipe {
+  rm -f "$c_passphrase_named_pipe"
+  mkfifo "$c_passphrase_named_pipe"
+}
+
 function select_disks {
   print_step_info_header
 
@@ -427,23 +452,25 @@ function ask_root_password_Debian {
 function ask_encryption {
   print_step_info_header
 
+  local passphrase=
+
   set +x
 
   if [[ -v ZFS_PASSPHRASE ]]; then
-    v_passphrase=$ZFS_PASSPHRASE
+    passphrase=$ZFS_PASSPHRASE
   else
     local passphrase_repeat=_
     local passphrase_invalid_message=
 
-    while [[ $v_passphrase != "$passphrase_repeat" || ${#v_passphrase} -lt 8 ]]; do
+    while [[ $passphrase != "$passphrase_repeat" || ${#passphrase} -lt 8 ]]; do
       local dialog_message="${passphrase_invalid_message}Please enter the passphrase (8 chars min.):
 
 Leave blank to keep encryption disabled.
 "
 
-      v_passphrase=$(whiptail --passwordbox "$dialog_message" 30 100 3>&1 1>&2 2>&3)
+      passphrase=$(whiptail --passwordbox "$dialog_message" 30 100 3>&1 1>&2 2>&3)
 
-      if [[ -z $v_passphrase ]]; then
+      if [[ -z $passphrase ]]; then
         break
       fi
 
@@ -453,6 +480,8 @@ Leave blank to keep encryption disabled.
     done
   fi
 
+  echo -n "$passphrase" > "$c_passphrase_named_pipe" &
+
   set -x
 }
 
@@ -570,7 +599,7 @@ function install_host_packages_Debian {
     echo "deb http://deb.debian.org/debian buster-backports main contrib" >> /etc/apt/sources.list
     apt update
 
-    apt install --yes -t buster-backports zfs-dkms
+    apt install --yes -t buster-backports zfs-dkms efibootmgr
 
     modprobe zfs
   fi
@@ -826,16 +855,23 @@ function custom_install_operating_system {
 function create_pools {
   # POOL OPTIONS #######################
 
+  local passphrase
   local encryption_options=()
   local rpool_disks_partitions=()
   local bpool_disks_partitions=()
 
   set +x
 
-  if [[ -n $v_passphrase ]]; then
+  passphrase=$(cat "$c_passphrase_named_pipe")
+
+  if [[ -n $passphrase ]]; then
     encryption_options=(-O "encryption=on" -O "keylocation=prompt" -O "keyformat=passphrase")
   fi
 
+  # Push back for unlogged reuse. Minor inconvenience, but worth :-)
+  #
+  echo -n "$passphrase" > "$c_passphrase_named_pipe" &
+
   set -x
 
   for selected_disk in "${v_selected_disks[@]}"; do
@@ -859,13 +895,11 @@ function create_pools {
   #
   # Stdin is ignored if the encryption is not set (and set via prompt).
   #
-  set +x
-  echo -n "$v_passphrase" | zpool create \
+  cat "$c_passphrase_named_pipe" | zpool create \
     "${encryption_options[@]}" \
     "${v_rpool_tweaks[@]}" \
     -O devices=off -O mountpoint=/ -R "$c_zfs_mount_dir" -f \
     "$v_rpool_name" $pools_mirror_option "${rpool_disks_partitions[@]}"
-  set -x
 
   # `-d` disable all the pool features (not used here);
   #
@@ -992,7 +1026,7 @@ APT'
   chroot_execute "apt update"
 
   chroot_execute 'echo "zfs-dkms zfs-dkms/note-incompatible-licenses note true" | debconf-set-selections'
-  chroot_execute "apt install --yes zfs-initramfs zfs-dkms grub-efi-amd64-signed shim-signed"
+  chroot_execute "apt install --yes rsync zfs-initramfs zfs-dkms grub-efi-amd64-signed shim-signed"
 }
 
 function install_jail_zfs_packages_elementary {
@@ -1256,10 +1290,12 @@ fi
 activate_debug
 set_distribution_data
 distro_dependent_invoke "store_os_distro_information"
+store_running_processes
 check_prerequisites
 display_intro_banner
 find_suitable_disks
 find_zfs_package_requirements
+create_passphrase_named_pipe
 
 select_disks
 distro_dependent_invoke "ask_root_password" --noforce