diff --git a/bin/setup-sourcezap b/bin/setup-sourcezap
index 6774a99..2f53c34 100755
--- a/bin/setup-sourcezap
+++ b/bin/setup-sourcezap
@@ -5,8 +5,6 @@ set -e
 # variables
 localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/..)}
 libexec="${localbase}"/libexec/sourcezap
-conf=$(cat "${localbase}"/share/sourcezap/doas.conf)
-doas="${localbase}"/etc/doas.conf
 
 ##
 # functions
@@ -14,25 +12,19 @@ doas="${localbase}"/etc/doas.conf
 
 ##
 # main
-if [ "$(id -u)" != "0" ]; then
+if [ "$(id -u)" = "0" ]; then
+    if id -u _sourcezap > /dev/null 2>&1; then
+        printok "_sourcezap user exists"
+    else
+        pw useradd -n _sourcezap \
+                   -c "sourcezap user" \
+                   -m \
+                   -s /sbin/nologin
+        chmod u=rwX,g=rX,o= /home/_sourcezap/
+        printok "_sourcezap user created"
+    fi
+    "${libexec}"/setup/setup-doas
+else
     printerr "you must be root"
     exit 1
 fi
-
-if id -u _sourcezap > /dev/null 2>&1; then
-    printok "_sourcezap user exists"
-else
-    pw useradd -n _sourcezap \
-        -c "sourcezap user" \
-        -m \
-        -s /sbin/nologin
-    chmod u=rwX,g=rX,o= /home/_sourcezap/
-    printok "create _sourcezap user"
-fi
-
-if grep -F "^${conf}$" "${doas}" > /dev/null 2>&1; then
-    printok "${doas} is up to date"
-else
-    echo "$conf" >> "$doas"
-    printok "update ${doas} (note: review the update)"
-fi
diff --git a/libexec/sourcezap/setup/setup-doas b/libexec/sourcezap/setup/setup-doas
new file mode 100755
index 0000000..7db3936
--- /dev/null
+++ b/libexec/sourcezap/setup/setup-doas
@@ -0,0 +1,28 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+localbase=$(realpath "$(dirname "$0")"/../../..)
+libexec="${localbase}"/libexec/sourcezap
+sharedir="${localbase}"/share/sourcezap
+
+##
+# functions
+. "${libexec}"/functions/print.sh
+
+install_doasconf()
+{
+    src="${sharedir}"/doas.conf
+    dest="${localbase}"/etc/doas.conf
+    if grep -Fq "$(cat "${src}")" "${dest}"; then
+        printok "doas.conf is up to date"
+    else
+        cat "${src}" >> "${dest}"
+        printok "${dest} updated"
+    fi
+}
+
+##
+# main
+install_doasconf