diff --git a/Makefile b/Makefile
index c2d06f6..ed65e3c 100644
--- a/Makefile
+++ b/Makefile
@@ -5,11 +5,12 @@ LIBEXECDIR = $(PREFIX)/libexec/portzap
 SHAREDIR = $(PREFIX)/share/portzap
 
 install:
-	install -d $(BINDIR) $(LIBEXECDIR) $(LIBEXECDIR)/commands $(LIBEXECDIR)/utils $(SHAREDIR) $(MANDIR)
+	install -d $(BINDIR) $(LIBEXECDIR) $(LIBEXECDIR)/commands $(LIBEXECDIR)/utils $(LIBEXECDIR)/setup $(SHAREDIR) $(MANDIR)
 	install -m 0755 bin/portzap $(BINDIR)
 	install -m 0755 bin/setup-portzap $(BINDIR)
 	install -m 0755 libexec/portzap/commands/* $(LIBEXECDIR)/commands
 	install -m 0755 libexec/portzap/utils/* $(LIBEXECDIR)/utils
+	install -m 0755 libexec/portzap/setup/* $(LIBEXECDIR)/setup
 	install -m 0644 share/portzap/* $(SHAREDIR)
 	install -m 0644 man/man8/portzap.8 $(MANDIR)
 
diff --git a/bin/setup-portzap b/bin/setup-portzap
index fcc08ba..bdc875e 100755
--- a/bin/setup-portzap
+++ b/bin/setup-portzap
@@ -4,9 +4,8 @@ set -e
 ##
 # variables
 localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/..)}
+sharedir="${localbase}"/share/portzap
 libexec="${localbase}"/libexec/portzap
-conf=$(cat "${localbase}"/share/portzap/doas.conf)
-doas="${localbase}"/etc/doas.conf
 
 ##
 # functions
@@ -33,15 +32,10 @@ else
         -m \
         -s /sbin/nologin
     chmod u=rwX,g=rX,o= /home/_portzap/
-    printok "create _portzap user"
+    printok "_portzap user created"
 fi
 
-if grep -F "^${conf}$" "${doas}" > /dev/null 2>&1; then
-    printok "${doas} is up to date"
-else
-    echo "$conf" >> "$doas"
-    printok "update ${doas} (note: review the update)"
-fi
-
-printf "Add user(s) to the _portzap group:\n"
+"${libexec}"/setup/setup-doas
+"${libexec}"/setup/setup-cron
+printf "\nAdd user(s) to the _portzap group:\n"
 printf "root# pw groupmod -n _portzap -m user1,user2\n"
diff --git a/libexec/portzap/setup/setup-cron b/libexec/portzap/setup/setup-cron
new file mode 100644
index 0000000..3b2db3d
--- /dev/null
+++ b/libexec/portzap/setup/setup-cron
@@ -0,0 +1,63 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+user="_portzap"
+localbase="$(realpath $(dirname $0)/../../..)"
+libexec="${localbase}/libexec/portzap"
+sharedir="${localbase}/share/portzap"
+
+##
+# functions
+printok() {
+    "${libexec}"/utils/printok "$1"
+}
+
+printerr() {
+    "${libexec}"/utils/printerr "$1"
+}
+
+verify_crontab()
+{
+    allowfile="/var/cron/allow"
+    if [ -e "${allowfile}" ]; then
+        if ! grep "${user}" "${allowfile}" > /dev/null 2>&1; then
+            printerr "in order to use the portzap crontab, add ${user} to ${allowfile}"
+            exit 1
+        fi
+        printok "${user} exists in ${allowfile}"
+    fi
+}
+
+install_crontab()
+{
+    src="${sharedir}/crontab"
+    dest="/var/cron/tabs/${user}"
+    if [ -e "${dest}" ]; then
+        yes | crontab -u "${user}" -r
+        printok "crontab removed (${dest})"
+    fi
+    crontab -u "${user}" "${src}"
+    chmod u=rw,g=,o= "${dest}"
+    printok "crontab installed (${dest})"
+}
+
+##
+# main
+printf "Do you want to run 'portzap pull' daily via cron(8) ? (yes|no) "
+while read -r r; do
+    case "${r}" in
+    y|Y|yes|YES)
+        verify_crontab
+        install_crontab
+        break
+        ;;
+    n|N|no|NO)
+        break
+        ;;
+    *)
+        printf "Please answer yes or no: "
+        ;;
+    esac
+done
diff --git a/libexec/portzap/setup/setup-doas b/libexec/portzap/setup/setup-doas
new file mode 100644
index 0000000..639ccd2
--- /dev/null
+++ b/libexec/portzap/setup/setup-doas
@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+user="_portzap"
+localbase="$(realpath $(dirname $0)/../../..)"
+libexec="${localbase}/libexec/portzap"
+sharedir="${localbase}/share/portzap"
+
+##
+# functions
+printok() {
+    "${libexec}"/utils/printok "$1"
+}
+
+printerr() {
+    "${libexec}"/utils/printerr "$1"
+}
+
+install_doasconf()
+{
+    src="${sharedir}/doas.conf"
+    dest="${localbase}/etc/doas.conf"
+    if grep -Fq "$(cat "${src}")" "${dest}"; then
+        printok "doas.conf looks up to date"
+    else
+        cat "${src}" >> "${dest}"
+        printok "${dest} has been updated"
+    fi
+}
+
+##
+# main
+install_doasconf
diff --git a/share/portzap/crontab b/share/portzap/crontab
new file mode 100644
index 0000000..e6064fb
--- /dev/null
+++ b/share/portzap/crontab
@@ -0,0 +1 @@
+0 0 * * * /usr/local/bin/portzap pull