diff --git a/internal/server/http/ui_handlers.go b/internal/server/http/ui_handlers.go
index 5afad0c..ee34408 100644
--- a/internal/server/http/ui_handlers.go
+++ b/internal/server/http/ui_handlers.go
@@ -370,8 +370,18 @@ func (s *Server) handleUIAddHostPost(w stdhttp.ResponseWriter, r *stdhttp.Reques
 		}
 	}
 
+	// Default repo username to the hostname when the operator left it
+	// blank. With rest-server's --private-repos this is what the URL
+	// path segment is expected to be anyway, and an htpasswd entry
+	// always needs *some* user — defaulting saves the operator from
+	// landing on a pending page with a half-formed snippet.
+	repoUsername := page.RepoUsername
+	if repoUsername == "" {
+		repoUsername = page.Hostname
+	}
+
 	if page.Error == "" {
-		token, _, err := s.mintEnrollmentToken(r.Context(), page.RepoURL, page.RepoUsername, repoPassword, splitPaths(page.Paths))
+		token, _, err := s.mintEnrollmentToken(r.Context(), page.RepoURL, repoUsername, repoPassword, splitPaths(page.Paths))
 		switch err {
 		case nil:
 			stdhttp.Redirect(w, r, "/hosts/pending/"+token, stdhttp.StatusSeeOther)
diff --git a/web/templates/pages/add_host.html b/web/templates/pages/add_host.html
index 2876261..8a20cf3 100644
--- a/web/templates/pages/add_host.html
+++ b/web/templates/pages/add_host.html
@@ -58,9 +58,9 @@
         <div class="field-help">Whatever <span class="mono text-ink-mid">restic -r</span> would accept. Most fleets terminate at a <span class="mono text-ink-mid">restic/rest-server</span>; <span class="mono text-ink-mid">s3:</span> and <span class="mono text-ink-mid">b2:</span> URLs work equally well.</div>
       </div>
       <div class="mb-5">
-        <label class="field-label" for="ah-user">Repo username <span class="text-ink-fade font-normal">· optional</span></label>
+        <label class="field-label" for="ah-user">Repo username <span class="text-ink-fade font-normal">· optional — defaults to hostname</span></label>
         <input id="ah-user" name="repo_username" type="text" class="field mono" value="{{$page.RepoUsername}}">
-        <div class="field-help">For <span class="mono text-ink-mid">rest-server</span> with htpasswd, this is the per-host user.</div>
+        <div class="field-help">For <span class="mono text-ink-mid">rest-server</span> with <span class="mono text-ink-mid">--private-repos</span>, this is the per-host htpasswd user — and the URL path segment must match. Leave blank and we'll use the hostname above.</div>
       </div>
       <div class="mb-7">
         <label class="field-label" for="ah-pass">Repo password <span class="text-ink-fade font-normal">· optional — leave blank to generate</span></label>
diff --git a/web/templates/pages/pending_host.html b/web/templates/pages/pending_host.html
index 78d4d87..9c81215 100644
--- a/web/templates/pages/pending_host.html
+++ b/web/templates/pages/pending_host.html
@@ -27,7 +27,7 @@
     the host detail.
   </p>
 
-  {{if and $page.RepoUsername $page.RepoPassword}}
+  {{if $page.RepoPassword}}
   <div class="snippet mt-6 panel" style="border-color: color-mix(in oklch, var(--warn), transparent 60%);">
     <div class="snippet-head" style="background: color-mix(in oklch, var(--warn), transparent 92%);">
       <span>