diff --git a/README.md b/README.md
index 86543bf..1036de6 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,9 @@ can be installed into `/usr/ports/` by root.
 
 #### CLI: setup-portzap
 
-This command should be run after installing portzap for
-the first time:
+`setup-portzap` should be run after installing portzap for
+the first time. <br> There is no harm in running `setup-portzap`
+multiple times:
 
     # Add the '_portzap' user, group and home directory
     # This command requires root privileges
diff --git a/bin/setup-portzap b/bin/setup-portzap
index d8450bf..f527c9e 100755
--- a/bin/setup-portzap
+++ b/bin/setup-portzap
@@ -13,16 +13,7 @@ libexec="${localbase}"/libexec/portzap
 ##
 # main
 if [ "$(id -u)" = "0" ]; then
-    if id -u _portzap > /dev/null 2>&1; then
-        printok "_portzap user exists"
-    else
-        pw useradd -n _portzap \
-                   -c "portzap user" \
-                   -m \
-                   -s /sbin/nologin
-        chmod u=rwX,g=rX,o= /home/_portzap/
-        printok "_portzap user created"
-    fi
+    "${libexec}"/setup/setup-user
     "${libexec}"/setup/setup-doas
 else
     printerr "you must be root"
diff --git a/libexec/portzap/setup/setup-user b/libexec/portzap/setup/setup-user
new file mode 100644
index 0000000..05fa94d
--- /dev/null
+++ b/libexec/portzap/setup/setup-user
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../..)}
+libexec="${localbase}"/libexec/portzap
+user="_portzap"
+
+##
+# functions
+. "${libexec}"/functions/print.sh
+
+##
+# main
+if id -u "${user}" > /dev/null 2>&1; then
+   printok "${user} user exists"
+else
+    pw useradd
+       -n "${user}" \
+       -c "portzap user" \
+       -m \
+       -s /sbin/nologin
+    chmod u=rwX,g=rX,o= /home/"${user}"/
+    printok "${user} user created"
+fi
diff --git a/share/portzap/RELNOTES b/share/portzap/RELNOTES
index eca0948..3e09797 100644
--- a/share/portzap/RELNOTES
+++ b/share/portzap/RELNOTES
@@ -1,5 +1,10 @@
 v?.?.?
 
+| Add libexec/portzap/setup/setup-user
+  Move the code that handles the creation of the '_portzap'
+  user from bin/setup-portzap to the libexec/portzap/setup/
+  directory
+
 | Set "diff.renameLimit" to unlimited
   After this change, portzap forwards "-l0" to "git diff"