diff --git a/README.md b/README.md
index c66ca49..0b86c69 100644
--- a/README.md
+++ b/README.md
@@ -133,8 +133,16 @@ The repo includes `.gitea/workflows/deploy.yaml` which, on push to `main`, SSHes
 If your service name or directory differ, update `SERVICE`/`APP_DIR` in the workflow accordingly.
 
 ```
+apt update
+apt install -y sudo
+
+SYSCTL_PATH=$(command -v systemctl)  # usually /bin/systemctl or /usr/bin/systemctl
+cat >/etc/sudoers.d/train-id <<EOF
+deployuser ALL=(root) NOPASSWD: ${SYSCTL_PATH} restart train-id, ${SYSCTL_PATH} restart train-id.service
+EOF
+chmod 440 /etc/sudoers.d/train-id
+visudo -cf /etc/sudoers.d/train-id
+
+sudo -n systemctl restart train-id
+```
 
-echo "deployuser ALL=(root) NOPASSWD: /bin/systemctl restart train-id.service" | sudo tee /etc/sudoers.d/train-id >/dev/null
-sudo chmod 440 /etc/sudoers.d/train-id
-sudo visudo -cf /etc/sudoers.d/train-id
-```
\ No newline at end of file