diff --git a/host_vars/musicdolphin.yml b/host_vars/musicdolphin.yml
index 662ee9b..ad4f3db 100644
--- a/host_vars/musicdolphin.yml
+++ b/host_vars/musicdolphin.yml
@@ -17,8 +17,7 @@ mediapi_ir_control: irserver
 # work there. Needs a libgpiod-based replacement before this goes back to true.
 mediapi_has_dhtsensor: false
 
-# Raspberry Pi 5. The SD card came from a Pi 4, whose image has no Pi 5 kernel.
-pi_standard_setup_install_pi5_kernel: true
+# Raspberry Pi 5 (detected from the device tree; the Pi 5 kernel is installed as needed).
 # The Pi is fed 5V through the HiFiBerry board's GPIO header, not USB-C, so it cannot
 # negotiate a 5A supply and would cap USB current at 600mA.
 hifiberry_powers_pi: true
diff --git a/roles/pi_standard_setup/defaults/main.yml b/roles/pi_standard_setup/defaults/main.yml
index 66c5f6d..337d19a 100644
--- a/roles/pi_standard_setup/defaults/main.yml
+++ b/roles/pi_standard_setup/defaults/main.yml
@@ -11,6 +11,7 @@ ansible_become_password: "raspberry"
 ansible_become: true
 
 # Install the Pi 5 (BCM2712) kernel, kernel_2712.img (an arm64 package, hence the :arm64 on
-# the armhf userland). A card imaged on a Pi 4 does not have
-# it, and a Pi 5 will not boot without. Harmless on a Pi 4, which keeps its own kernel.
-pi_standard_setup_install_pi5_kernel: false
+# an armhf userland). A card imaged on a Pi 4 does not have it, and a Pi 5 will not boot
+# without. "auto" installs it when the detected model is a Pi 5 (a no-op on current
+# images, which ship it); set true/false to force.
+pi_standard_setup_install_pi5_kernel: auto
diff --git a/roles/pi_standard_setup/tasks/main.yml b/roles/pi_standard_setup/tasks/main.yml
index a83e1b5..19dc492 100644
--- a/roles/pi_standard_setup/tasks/main.yml
+++ b/roles/pi_standard_setup/tasks/main.yml
@@ -116,11 +116,17 @@
     cache_valid_time: 7200
     state: present
 - name: Install the Pi 5 kernel
+  # Only where it can matter: a Pi 5 running an image that was built for an older Pi
+  # (a card moved over from a Pi 4). A current arm64 image already ships it, and then
+  # this is a no-op; an armhf userland needs the arm64 kernel package cross-installed.
   ansible.builtin.apt:
     name: "linux-image-rpi-2712:arm64"
     cache_valid_time: 7200
     state: present
-  when: pi_standard_setup_install_pi5_kernel
+  when: >-
+    (pi_standard_setup_install_pi5_kernel | string | lower == 'true')
+    or (pi_standard_setup_install_pi5_kernel | string | lower == 'auto'
+        and 'Raspberry Pi 5' in (pi_standard_setup_raspberry_model.content | b64decode))
   notify: Reboot after standard setup
 - name: Copy vim config
   ansible.builtin.copy: