diff --git a/bin/omarchy-setup-hardware b/bin/omarchy-setup-hardware
index ebfcdbb4..2e9320b0 100755
--- a/bin/omarchy-setup-hardware
+++ b/bin/omarchy-setup-hardware
@@ -4,6 +4,7 @@
 # omarchy:group=setup
 # omarchy:requires-sudo=true
 # omarchy:examples=omarchy setup hardware --install-user dhh
+# omarchy:hidden=true
 
 set -euo pipefail
 
diff --git a/bin/omarchy-setup-lock b/bin/omarchy-setup-lock
index 3837ec97..55c7e0f1 100755
--- a/bin/omarchy-setup-lock
+++ b/bin/omarchy-setup-lock
@@ -4,6 +4,7 @@
 # omarchy:group=setup
 # omarchy:name=lock
 # omarchy:requires-sudo=true
+# omarchy:hidden=true
 
 set -e
 
diff --git a/bin/omarchy-setup-system b/bin/omarchy-setup-system
index b55296c2..7e2f65e6 100755
--- a/bin/omarchy-setup-system
+++ b/bin/omarchy-setup-system
@@ -4,6 +4,7 @@
 # omarchy:group=setup
 # omarchy:requires-sudo=true
 # omarchy:examples=omarchy setup system --install-user dhh --first-install
+# omarchy:hidden=true
 
 set -euo pipefail
 
diff --git a/test/cli b/test/cli
index dfd819c0..8a9112b5 100755
--- a/test/cli
+++ b/test/cli
@@ -182,6 +182,24 @@ if [[ $output == *"omarchy update perform"* ]]; then
 fi
 pass "hidden update perform compatibility wrapper is not shown"
 
+# The setup group is for interactive wizards. These three are install-time
+# plumbing the ISO and install leaves call, so they stay out of the listing a
+# user browses -- while still routing, because those callers use the CLI.
+for internal in omarchy-setup-system omarchy-setup-hardware omarchy-setup-lock; do
+  if "$CLI" commands --json | jq -e --arg binary "$internal" \
+    '.commands[] | select(.binary == $binary)' >/dev/null; then
+    fail "$internal stays out of the default command listing"
+  fi
+
+  "$CLI" commands --all --json | jq -e --arg binary "$internal" \
+    '.commands[] | select(.binary == $binary) | select(.hidden)' >/dev/null ||
+    fail "$internal is still listed by commands --all"
+done
+pass "install-time setup plumbing is hidden from the setup wizards"
+
+output=$(timeout 5 "$CLI" setup hardware --help)
+assert_output_contains "hidden setup plumbing still routes" "$output" "omarchy-setup-hardware"
+
 output=$("$CLI" screenshot --help)
 assert_output_contains "root alias resolves to command help" "$output" "omarchy-capture-screenshot"