diff --git a/libexec/portzap/git-changed-files b/libexec/portzap/git-changed-files
new file mode 100644
index 0000000..afbc658
--- /dev/null
+++ b/libexec/portzap/git-changed-files
@@ -0,0 +1,14 @@
+#!/bin/sh -e
+
+##
+# variables
+gitdir=$1
+commit=$2
+
+##
+# main
+cd ${gitdir}
+add=$(git diff --name-only --diff-filter=A ${commit} HEAD)
+mod=$(git diff --name-only --diff-filter=M ${commit} HEAD)
+echo ${add}
+echo ${mod}
diff --git a/libexec/portzap/git-removed-files b/libexec/portzap/git-removed-files
new file mode 100644
index 0000000..48219c1
--- /dev/null
+++ b/libexec/portzap/git-removed-files
@@ -0,0 +1,11 @@
+#!/bin/sh -e
+
+##
+# variables
+gitdir=$1
+commit=$2
+
+##
+# main
+cd ${gitdir}
+git diff --name-only --diff-filter=D ${commit} HEAD
diff --git a/libexec/portzap/git-rev b/libexec/portzap/git-rev
new file mode 100644
index 0000000..a5cf25a
--- /dev/null
+++ b/libexec/portzap/git-rev
@@ -0,0 +1,10 @@
+#!/bin/sh -e
+
+##
+# variables
+gitdir=$1
+
+##
+# main
+cd ${gitdir}
+git rev-parse HEAD
diff --git a/libexec/portzap/portzap-install b/libexec/portzap/portzap-install
index 23d5b42..710ccad 100755
--- a/libexec/portzap/portzap-install
+++ b/libexec/portzap/portzap-install
@@ -4,16 +4,47 @@
 # variables
 gitdir=$1
 installdir=$2
-excludes=".git .gitignore .hooks .arcconfig"
+revfile=$3
+artifacts=".git .gitignore .hooks .arcconfig"
+libexec=/usr/local/libexec/portzap
+
+##
+# functions
+perform_update()
+{
+    rev=$(cat "${revfile}")
+    add=$(doas -u _portzap ${libexec}/git-changed-files "${gitdir}" "${rev}")
+    del=$(doas -u _portzap ${libexec}/git-removed-files "${gitdir}" "${rev}")
+    set -x
+    for file in ${del}; do
+        target="${installdir}/${file}"
+        rm "${target}"
+    done
+    for file in ${add}; do
+        target="${installdir}/${file}"
+        cp "${file}" "${target}"
+        chown root:_portzap "${target}"
+        chmod u=rw,g=rw,o= "${target}"
+    done
+}
+
+perform_install()
+{
+    find -s . -maxdepth 1 \
+        -exec cp -Rfv {} "${installdir}" \; \
+        -exec chown -R root:_portzap "${installdir}/{}" \; \
+        -exec chmod -R u=rwX,g=rwX,o= "${installdir}/{}" \;
+    for path in ${artifacts}; do
+        rm -rf "${installdir}/${path}"
+    done
+}
 
 ##
 # main
 cd "${gitdir}"
-find -s . -maxdepth 1 \
-    -exec cp -Rfv {} "${installdir}" \; \
-    -exec chown -R root:_portzap "${installdir}/{}" \; \
-    -exec chmod -R u=rwX,g=rwX,o= "${installdir}/{}" \;
-cd "${installdir}"
-for exclude in ${excludes}; do
-    rm -rf "${exclude}"
-done
+if [ -e "${revfile}" ]; then
+    perform_update
+else
+    perform_install
+fi
+echo $(doas -u _portzap ${libexec}/git-rev ${gitdir}) > ${revfile}
diff --git a/share/portzap/doas.conf b/share/portzap/doas.conf
index 5ec6ddd..73e1193 100644
--- a/share/portzap/doas.conf
+++ b/share/portzap/doas.conf
@@ -1,2 +1,7 @@
+##
+# portzap
 permit nopass :_portzap as _portzap cmd /usr/local/libexec/portzap/portzap-clone
 permit nopass :_portzap as _portzap cmd /usr/local/libexec/portzap/portzap-pull
+permit nopass root as _portzap cmd /usr/local/libexec/portzap/git-changed-files
+permit nopass root as _portzap cmd /usr/local/libexec/portzap/git-removed-files
+permit nopass root as _portzap cmd /usr/local/libexec/portzap/git-rev