diff --git a/README.md b/README.md
index f39bf5a..4dd6799 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,9 @@ can be installed into `/usr/src/` by root.
 
 #### CLI: setup-sourcezap
 
-This command should be run after installing sourcezap for
-the first time:
+`setup-sourcezap` should be run after installing
+sourcezap for the first time. <br> There is no harm in
+running `setup-sourcezap` multiple times:
 
     # Add the '_sourcezap' user, group and home directory
     # This command requires root privileges
diff --git a/bin/setup-sourcezap b/bin/setup-sourcezap
index 2f53c34..3e64eb8 100755
--- a/bin/setup-sourcezap
+++ b/bin/setup-sourcezap
@@ -13,16 +13,7 @@ libexec="${localbase}"/libexec/sourcezap
 ##
 # main
 if [ "$(id -u)" = "0" ]; then
-    if id -u _sourcezap > /dev/null 2>&1; then
-        printok "_sourcezap user exists"
-    else
-        pw useradd -n _sourcezap \
-                   -c "sourcezap user" \
-                   -m \
-                   -s /sbin/nologin
-        chmod u=rwX,g=rX,o= /home/_sourcezap/
-        printok "_sourcezap user created"
-    fi
+    "${libexec}"/setup/setup-user
     "${libexec}"/setup/setup-doas
 else
     printerr "you must be root"
diff --git a/libexec/sourcezap/setup/setup-user b/libexec/sourcezap/setup/setup-user
new file mode 100755
index 0000000..ab90656
--- /dev/null
+++ b/libexec/sourcezap/setup/setup-user
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../..)}
+libexec="${localbase}"/libexec/sourcezap
+user="_sourcezap"
+
+##
+# functions
+. "${libexec}"/functions/print.sh
+
+##
+# main
+if id -u "${user}" > /dev/null 2>&1; then
+   printok "${user} user exists"
+else
+    pw useradd
+       -n "${user}" \
+       -c "sourcezap user" \
+       -m \
+       -s /sbin/nologin
+    chmod u=rwX,g=rX,o= /home/"${user}"/
+    printok "${user} user created"
+fi
diff --git a/share/sourcezap/RELNOTES b/share/sourcezap/RELNOTES
index e79b840..0f220eb 100644
--- a/share/sourcezap/RELNOTES
+++ b/share/sourcezap/RELNOTES
@@ -1,5 +1,10 @@
 v?.?.?
 
+| Add libexec/sourcezap/setup/setup-user
+Move the code that handles the creation of the '_sourcezap'
+user from bin/setup-sourcezap to the libexec/sourcezap/setup/
+directory
+
 | Recover from "git checkout" failure
 After this change, "git checkout" exiting unsuccessfully
 towards the end of "sourcezap clone" no longer causes