diff --git a/server/README.md b/server/README.md
index 4a5ac15..5edc5cb 100644
--- a/server/README.md
+++ b/server/README.md
@@ -39,7 +39,11 @@ The scheduled task `KiK restore shell files` runs every 30 minutes and at every
 stop it: the task, its script and the copies it restores from are readable and writable only by SYSTEM and the
 administrators.
 
-What it does:
+Neither the setup nor the cleanup ever runs as the `root` user. The setup runs in an elevated PowerShell, as an
+administrator, and refuses to run without those rights; the cleanup runs as SYSTEM. The `root` account is a
+different one, without administrator rights, and it never executes any of it.
+
+What the cleanup does:
 
 1. Creates `/home/root` if it is gone, and gives the `root` account write access on it.
 2. Puts every copy in `files/` back into the home directory: the shell configuration and the four text files.
@@ -50,11 +54,12 @@ undoes that.
 
 ## This directory
 
-- `resources/` - the copies the cleanup restores from: the four text files and the shell configuration.
-- `scripts/make_files.py` - builds the four text files from the website's pages.
+- `shell/` - the shell configuration, `~/.zshrc` and `~/.zshenv`, which is where the prompt is set.
+- `resources/` - the copies the cleanup restores from: the shell configuration and the four text files.
+- `scripts/make_files.py` - builds the resources.
 - `scripts/install_restore_task.ps1` - installs the scheduled task.
 
-The four text files are generated, the shell configuration is copied from the server by hand:
+The resources are built from the website's pages and the shell configuration:
 
     python3 server/scripts/make_files.py
 
diff --git a/server/scripts/make_files.py b/server/scripts/make_files.py
index db3209d..fe2100a 100644
--- a/server/scripts/make_files.py
+++ b/server/scripts/make_files.py
@@ -1,7 +1,9 @@
-# Builds README, README.en, CODE_OF_CONDUCT and CODE_OF_CONDUCT.en in ../resources: the website's pages as
-# terminal text with escape sequences, for the home directory of the shell server's root user.
+# Builds the files for the home directory of the shell server's root user in ../resources: README, README.en,
+# CODE_OF_CONDUCT and CODE_OF_CONDUCT.en as the website's pages in terminal text with escape sequences, and the
+# shell configuration from ../shell.
 # Usage: python3 server/scripts/make_files.py
 import pathlib
+import shutil
 import textwrap
 
 ESC = '\x1b'
@@ -334,3 +336,6 @@ out.mkdir(exist_ok=True)
 for name, text in [('README', readme(DE)), ('README.en', readme(EN)),
                    ('CODE_OF_CONDUCT', code_of_conduct(COC_DE)), ('CODE_OF_CONDUCT.en', code_of_conduct(COC_EN))]:
     (out / name).write_text(text, encoding='utf-8')
+# The shell configuration is not generated, it is copied from ../shell, where it is edited.
+for name in '.zshrc', '.zshenv':
+    shutil.copyfile(pathlib.Path(__file__).parent.parent / 'shell' / name, out / name)
diff --git a/server/shell/.zshenv b/server/shell/.zshenv
new file mode 100644
index 0000000..f990c34
--- /dev/null
+++ b/server/shell/.zshenv
@@ -0,0 +1,3 @@
+# Preset what MSYS2's /etc/profile would otherwise start a helper process for (~90 ms each here).
+# TZ has to match the Windows timezone (W. Europe Standard Time).
+export LANG=en_US.UTF-8 TZ=Europe/Berlin
diff --git a/server/shell/.zshrc b/server/shell/.zshrc
new file mode 100644
index 0000000..310de44
--- /dev/null
+++ b/server/shell/.zshrc
@@ -0,0 +1,36 @@
+# History shared between sessions.
+HISTFILE=~/.zsh_history HISTSIZE=10000 SAVEHIST=10000
+setopt share_history hist_ignore_dups hist_ignore_space interactive_comments auto_cd
+
+# Completion: menu, case-insensitive, colored. -C skips compaudit, which is slow on
+# Windows and meaningless under MSYS2's noacl mounts (rm ~/.zcompdump after adding completions).
+autoload -Uz compinit && compinit -C
+zstyle ':completion:*' menu select
+zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
+zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
+
+# Emacs keys; Up/Down search history for what is already typed.
+bindkey -e
+autoload -Uz up-line-or-beginning-search down-line-or-beginning-search
+zle -N up-line-or-beginning-search && zle -N down-line-or-beginning-search
+bindkey '^[[A' up-line-or-beginning-search '^[OA' up-line-or-beginning-search
+bindkey '^[[B' down-line-or-beginning-search '^[OB' down-line-or-beginning-search
+
+# Prompt: user@host:directory, git branch, exit status of the last command if it failed.
+# A literal '#' as on Linux: zsh's %# would show '%', since this root is not uid 0.
+# The branch is read from .git/HEAD directly: starting git on every prompt is slow on Windows.
+precmd() {
+  local d=$PWD head=
+  until [[ -e $d/.git || $d == / ]]; do d=${d:h}; done
+  [[ -f $d/.git/HEAD ]] && read -r head < $d/.git/HEAD
+  [[ $head == 'ref: '* ]] && git_branch=${head#ref: refs/heads/} || git_branch=${head:0:7}
+  print -Pn '\e]0;%n@%m: %~\a'
+}
+setopt prompt_subst
+PROMPT='%F{green}%n@%m%f:%F{blue}%~%f${git_branch:+ %5F($git_branch)%f}%(?.. %F{red}[%?]%f)# '
+
+alias ls='ls --color=auto' ll='ls -lah' grep='grep --color=auto'
+
+# Process monitor: htop does not exist for MSYS2 (its /proc only shows MSYS2 processes).
+# bottom is a native Windows program; winpty lets it draw in the pty, as Server 2016 has no ConPTY.
+alias btm='winpty /ucrt64/bin/btm'