diff --git a/Makefile b/Makefile
index 45db5f9ad5..5b30e7f877 100644
--- a/Makefile
+++ b/Makefile
@@ -57,16 +57,12 @@ test: config
 verify:
 	./hack/verify.sh
 
+.PHONY: update-prep
+update-prep: config test peribolos
+
 .PHONY: deploy # --confirm
-deploy: config test peribolos
-	$(PERIBOLOS_CMD) \
-		--config-path $(MERGED_CONFIG) \
-		--fix-org \
-		--fix-org-members \
-		--fix-teams \
-		--fix-team-members \
-		$(shell [ -n "${GITHUB_TOKEN_PATH}" ] && echo "--github-token-path=${GITHUB_TOKEN_PATH}") \
-		$(patsubst %, --required-admins=%, $(ADMINS)) \
+deploy:
+	./admin-update.sh
 		$(-*-command-variables-*-) $(filter-out $@,$(MAKECMDGOALS))
 
 # actual targets that only get built if they don't already exist
diff --git a/admin/update.sh b/admin/update.sh
index 7784f4fed0..05fed3674f 100755
--- a/admin/update.sh
+++ b/admin/update.sh
@@ -13,20 +13,33 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-if [[ $# -lt 6 ]]; then
-  echo "Usage: bazel run //admin:update -- --github-token-path ~/my/github/token # --confirm" >&2
-  exit 1
-fi
-
 set -o errexit
 set -o nounset
 set -o pipefail
-set -o xtrace
+set -x
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
+readonly REPO_ROOT
+
+readonly admins=(
+  cblecker
+  fejta
+  idvoretskyi
+  mrbobbytables
+  nikhita
+  spiffxp
+)
+
+cd "${REPO_ROOT}"
+make update-prep
+cmd="${REPO_ROOT}/_output/bin/peribolos"
+args=(
+  --config-path="${REPO_ROOT}/_output/gen-config.yaml"
+  --fix-org
+  --fix-org-members
+  --fix-teams
+  --fix-team-members
+  "${admins[@]/#/--required-admins=}"
+)
 
-pushd "$(dirname "$(realpath "$BASH_SOURCE")")"
-bazel test //config:all
-popd
-peribolos="$1"
-shift
-echo $@
-"$peribolos" $@
+"${cmd}" "${args[@]}" "${@}"