diff --git a/README.md b/README.md
index 4652c35..8482ec4 100644
--- a/README.md
+++ b/README.md
@@ -59,19 +59,21 @@ Retiring the pre-rename `gitea-events` route is therefore a one-off, done by
 hand after the first deploy of both hosts:
 
 ```
-# on mars — drop the old subscription
-sudo podman exec hermes-agent hermes webhook remove gitea-events
+# on mars — drop the old subscription (`hermes` is the alias in common.nix)
+hermes webhook remove gitea-events
 
 # on jupiter — delete the old hook (it posts to the relay's bare /gitea path)
 api=http://127.0.0.1:3000/api/v1; repo=darman/homelab
-tok="$(sudo cat /run/secrets/gitea_provisioning_token)"
-old="$(curl -fsS -H "Authorization: token $tok" "$api/repos/$repo/hooks" \
-  | jq -r '.[] | select(.config.url == "http://mars.orbit.sol:8645/gitea") | .id')"
-for id in $old; do
-  curl -fsS -H "Authorization: token $tok" -X DELETE "$api/repos/$repo/hooks/$id"
+auth=(-H "Authorization: token $(sudo cat /run/secrets/gitea_provisioning_token)")
+for id in $(curl -fsS "${auth[@]}" "$api/repos/$repo/hooks" \
+    | jq -r '.[] | select(.config.url == "http://mars.orbit.sol:8645/gitea") | .id'); do
+  curl -fsS "${auth[@]}" -X DELETE "$api/repos/$repo/hooks/$id"
 done
 ```
 
+Or just delete it in the web UI: repo Settings -> Webhooks, the entry whose
+URL ends in `:8645/gitea` with no route after it.
+
 Check `hermes webhook list` and the repo's webhook page afterwards; until the
 old hook is gone both it and the new one fire, so events arrive twice.
 
diff --git a/common.nix b/common.nix
index 3284006..32cf979 100644
--- a/common.nix
+++ b/common.nix
@@ -51,7 +51,7 @@
     options = "--delete-older-than 30d";
   };
 
-  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
+  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd jq ];
 
   # ---- home-manager (user-level config for darman, all hosts) ----
   # Requires home-manager.nixosModules.home-manager in the host's own