diff --git a/sysop/client b/sysop/client
old mode 100644
new mode 100755
index c4ed3f9..4da195c
--- a/sysop/client
+++ b/sysop/client
@@ -1,3 +1,4 @@
 #!/bin/sh
 
-socat - udp:localhost:5557 <<< "shutdown:$(<shutdown.pre)"
+CMD=${1-shutdown}
+socat - udp:localhost:5557 <<< "$CMD:$(<$CMD.pre)"
diff --git a/sysop/install b/sysop/install
new file mode 100644
index 0000000..6c539f1
--- /dev/null
+++ b/sysop/install
@@ -0,0 +1 @@
+useradd -d /var/empty -s /sbin/nologin sysop
diff --git a/sysop/openbsd.toml b/sysop/openbsd.toml
index ad8f29a..5ac46b8 100644
--- a/sysop/openbsd.toml
+++ b/sysop/openbsd.toml
@@ -1,10 +1,18 @@
 app = "sysop"
 
 [[site.patch.doas.files]]
-lines = [ "permit nopass :wheel" ]
+lines = [
+    "permit nopass :wheel",
+    "permit nopass sysop as root cmd /usr/bin/nc args -ulkd 0.0.0.0 557",
+    "permit nopass sysop as root cmd /sbin/shutdown",
+]
 mode = 0o400
 dst = "/etc/doas.conf"
 
+[site.patch.sysop]
+service = "sysop"
+install = "install"
+
 [[site.patch.sysop.files]]
 src = "server"
 mode = 0o755
@@ -14,14 +22,15 @@ dst = "/usr/local/bin/sysop"
 src = "shutdown.cmd"
 dst = "/var/sysop/commands/shutdown"
 
-[[site.patch.sysop.files]]
-src = "shutdown.cmd"
-dst = "/var/sysop/commands/shutdown"
-
 [[site.patch.sysop.files]]
 src = "shutdown.tok"
 dst = "/var/sysop/tokens/shutdown"
 
+[[site.patch.sysop.files]]
+src = "service"
+mode = 0o755
+dst = "/etc/rc.d/sysop"
+
 [[run.hostfwd.udp]]
 hport = 5557
 gport = 557
diff --git a/sysop/server b/sysop/server
index fce8f65..dbfff3e 100755
--- a/sysop/server
+++ b/sysop/server
@@ -4,7 +4,7 @@ PORT=557
 ADDR=0.0.0.0
 
 log() {
-    logger -ct sysop -f-
+    logger -ct sysop
 }
 
 ROOT=/var/sysop
@@ -12,7 +12,7 @@ TOKENS=$ROOT/tokens
 COMMANDS=$ROOT/commands
 
 echo "listening udp:$ADDR:$PORT" | log
-doas nc -ulkd "$ADDR" "$PORT" | while IFS=: read CMD TOKEN; do
+doas "$(which /usr/bin/nc)" -ulkd "$ADDR" "$PORT" | while IFS=: read CMD TOKEN; do
     if [ ! -f "$TOKENS/$CMD" ] || [ ! -f "$COMMANDS/$CMD" ]; then
         echo "unknown command: $CMD" | log
         continue
diff --git a/sysop/service b/sysop/service
new file mode 100644
index 0000000..b13c404
--- /dev/null
+++ b/sysop/service
@@ -0,0 +1,9 @@
+#!/bin/ksh
+
+daemon="/usr/local/bin/sysop"
+daemon_user=sysop
+rc_bg=YES
+
+. /etc/rc.d/rc.subr
+
+rc_cmd $1
diff --git a/sysop/shutdown.cmd b/sysop/shutdown.cmd
index 82f80da..1cd46fe 100644
--- a/sysop/shutdown.cmd
+++ b/sysop/shutdown.cmd
@@ -1 +1 @@
-doas shutdown -p now
+doas /sbin/shutdown -p now