diff --git a/Makefile b/Makefile
index 35ecb59..3c6c453 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,7 @@ SHAREDIR = $(PREFIX)/share/portzap
 install:
 	install -d $(BINDIR) $(LIBEXECDIR) $(SHAREDIR) $(MANDIR)
 	install -m 0755 bin/portzap $(BINDIR)
+	install -m 0755 bin/setup-portzap $(BINDIR)
 	install -m 0755 libexec/portzap/* $(LIBEXECDIR)
 	install -m 0644 share/portzap/* $(SHAREDIR)
 	install -m 0644 man/man8/portzap.8 $(MANDIR)
diff --git a/README.md b/README.md
index fac206e..9eb1eac 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,17 @@ can be installed to `/usr/ports` by root.
 
 ## Examples
 
-**CLI**
+### CLI: setup-portzap
+
+This command should be run after installing portzap for
+the first time.
+
+    # Add the portzap user, group and home directory.
+    # This command requires root privileges.
+    # setup-portzap
+
+### CLI: portzap
+
 
     # Clone the hardenedbsd ports tree into /home/_portzap/ports/.
     # This command is delegated to the '_portzap' user.
@@ -27,11 +37,8 @@ can be installed to `/usr/ports` by root.
     # This command requires root privileges.
     # portzap install
 
-    # Add the portzap user, group and home directory.
-    # This command requires root privileges.
-    # portzap setup
 
-**ENVIRONMENT**
+### ENVIRONMENT
 
 * __$PORTZAP\_GITURL__ <br>
   The URL to a git repository.  <br>
diff --git a/bin/portzap b/bin/portzap
index a1c3aa5..2d1a116 100755
--- a/bin/portzap
+++ b/bin/portzap
@@ -12,18 +12,10 @@ libexec="${localbase}"/libexec/portzap
 
 ##
 # functions
-require_root() {
-    if [ "$(id -u)" != "0" ]; then
-        echo "This command requires root privileges."
-        exit 1
-    fi
-
-}
-
 require_membership_of() {
     group=$1
     if ! id -Gn | tr ' ' '\n' | grep -e "^${group}$" > /dev/null 2>&1; then
-        echo "This command requires a user to be a member of ${group}."
+        echo "[-] This command requires a user to be a member of ${group}."
         exit 1
     fi
 }
@@ -32,7 +24,7 @@ require_dependency() {
     deps=$1
     for dep in $deps; do
         if ! which -s "$dep"; then
-            echo "This command requires ${dep}, but it was not found."
+            echo "[-] This command requires ${dep}, but ${dep} wasn't found"
             exit 1
         fi
     done
@@ -72,10 +64,6 @@ case $1 in
         require_dependency "git doas"
         "${libexec}"/portzap-install "${gitdir}" "${installdir}" "${revision}"
         ;;
-    "setup")
-        require_root
-        "${libexec}"/portzap-setup
-        ;;
     *)
         printf "Usage: portzap COMMAND [OPTIONS]\n"
         printf "\n"
@@ -84,6 +72,5 @@ case $1 in
         printf "  pull     Pull updates from the hardenedbsd ports tree.\n"
         printf "  erase    Erase /usr/ports/ and /home/_portzap/ports/.\n"
         printf "  install  Install the ports tree into /usr/ports/.\n"
-        printf "  setup    Add the _portzap user, group and home directory.\n"
         ;;
 esac
diff --git a/libexec/portzap/portzap-setup b/bin/setup-portzap
similarity index 90%
rename from libexec/portzap/portzap-setup
rename to bin/setup-portzap
index 2a25011..6b673cc 100755
--- a/libexec/portzap/portzap-setup
+++ b/bin/setup-portzap
@@ -8,6 +8,11 @@ doas="${localbase}"/etc/doas.conf
 
 ##
 # main
+if [ "$(id -u)" != "0" ]; then
+    echo "[-] This command must be run as root"
+    exit 1
+fi
+
 if id -u _portzap > /dev/null 2>&1; then
     echo "[-] The _portzap user exists"
     echo "[-] Add user(s) to the _portzap group:"
diff --git a/man/man8/portzap.8 b/man/man8/portzap.8
index 6fdddca..85a2da7 100644
--- a/man/man8/portzap.8
+++ b/man/man8/portzap.8
@@ -13,8 +13,6 @@ portzap pull
 portzap erase
 .br
 portzap install
-.br
-portzap setup
 .Sh DESCRIPTION
 .Nm portzap
 manages a copy of the hardenedbsd ports tree.
@@ -49,11 +47,6 @@ Install /home/_portzap/ports/ into /usr/ports/.
 .br
 This command requires root privileges.
 .Pp
-.Nm portzap setup
-.br
-Add the portzap user, group and home directory.
-.br
-This command requires root privileges.
 .Sh ENVIRONMENT
 .sp
 .sp