diff --git a/docs/architecture/overview.md b/docs/architecture/overview.md
index e77a8bb..f370b4f 100644
--- a/docs/architecture/overview.md
+++ b/docs/architecture/overview.md
@@ -217,7 +217,7 @@ flowchart LR
     end
 
     subgraph etc["/etc/hispec"]
-        ENV["instances/&lt;name&gt;.env<br/>HISPEC_DAEMON, HISPEC_CONFIG"]
+        ENV["instances/&lt;name&gt;.env<br/>HISPEC_DAEMON, HISPEC_HOST"]
         YML["&lt;name&gt;.yaml<br/>deployed config"]
     end
 
@@ -231,8 +231,9 @@ flowchart LR
 
 One systemd template unit, `hispec@.service`, runs every daemon. An
 instance `hispec@<name>` reads `/etc/hispec/instances/<name>.env`, which
-names the daemon script (`HISPEC_DAEMON`, relative to `daemons/`) and its config
-(`HISPEC_CONFIG`). Running a second unit of the same hardware model — two
+names the daemon script (`HISPEC_DAEMON`, relative to `daemons/`). Its config
+is `/etc/hispec/<name>.yaml`, derived from the instance name rather than
+declared. Running a second unit of the same hardware model, two
 Lakeshores, five filter wheels — is two env files pointing at the same script
 with different configs.
 
diff --git a/docs/operations/systemd.md b/docs/operations/systemd.md
index 293cc3e..32efa28 100644
--- a/docs/operations/systemd.md
+++ b/docs/operations/systemd.md
@@ -36,7 +36,7 @@ An instance gets its identity from two files:
 
 | File | What it says |
 |---|---|
-| `/etc/hispec/instances/<name>.env` | which daemon script to run (`HISPEC_DAEMON`) and which config to hand it (`HISPEC_CONFIG`) |
+| `/etc/hispec/instances/<name>.env` | which daemon script to run (`HISPEC_DAEMON`) and which host should run it (`HISPEC_HOST`) |
 | `/etc/hispec/<name>.yaml` | the config itself: serial ports, addresses, limits, keyword names |
 
 So running a second Lakeshore is not new code and not a new unit. It is a
@@ -239,7 +239,6 @@ matching `systemd/instances/<name>.env`:
 
 ```sh
 HISPEC_DAEMON=<path relative to daemons/, e.g. generic/inficon or hsfei/adc>
-HISPEC_CONFIG=/etc/hispec/<name>.yaml
 HISPEC_HOST=<the host that runs it, e.g. hispecserver or fei>
 ```
 
@@ -368,10 +367,11 @@ Common causes, in the order they bite:
 - **`Failed to load environment files`**: `/etc/hispec/instances/<name>.env`
   is missing or unreadable. The instance name in the command must match the
   file name exactly.
-- **`No such file or directory`** on the config: `HISPEC_CONFIG` points
-  somewhere that does not exist. The config has to be deployed to `/etc/hispec/`
-  as well as the `.env`. `hispec deploy <name>` copies both; copying one by
-  hand and forgetting the other is the usual mistake.
+- **`No such file or directory`** on the config: the unit passes
+  `/etc/hispec/<name>.yaml`, derived from the instance name, and nothing is
+  there. The config has to be deployed as well as the `.env`. `hispec deploy
+  <name>` copies both; copying one by hand and forgetting the other is the
+  usual mistake.
 - **A serial port or USB error**: the device is unplugged, powered off, or
   claimed by another process. Two instances pointing at the same port will do
   this to each other, and so will a daemon left running from a manual test.
@@ -505,12 +505,17 @@ sudo ./systemd/install.sh alice bob          # operator usernames
 `install.sh` is idempotent. Re-run it:
 
 - to enrol more operators (`sudo ./systemd/install.sh carol`);
-- after a pull that changed dependencies in `pyproject.toml`, or
-  `hispec@.service`, the polkit rule or `hispec-enable` under `systemd/`;
+- after a pull that changed dependencies in `pyproject.toml`, or the unit or
+  polkit rule in `instrumentctl`;
 - to repair a host `hispec doctor` says is broken.
 
 You do **not** need it to add a daemon or to pick up code changes;
-[`hispec deploy`](#deploying-an-instance) and a `git pull` cover those. It:
+[`hispec deploy`](#deploying-an-instance) and a `git pull` cover those.
+
+The script itself only bootstraps a pinned `uv` and builds the venv at
+`/opt/hispec/venv`, which is also where the `hispec` command comes from. It
+then hands over to `hispec install`, which lives in `instrumentctl` and does
+the rest:
 
 - creates the `hispec-ops` group and the unprivileged `hispec` system user the
   daemons run as;
@@ -518,17 +523,17 @@ You do **not** need it to add a daemon or to pick up code changes;
 - creates `/etc/hispec/{,instances/}` and `/var/log/hispec/`, group-owned by
   `hispec-ops` and setgid so files created by one operator stay readable by the
   rest;
-- creates `/etc/hispec/secrets.env`, writable by `hispec-ops`;
-- creates the venv at `/opt/hispec/venv` with the repo `pip install -e`'d into
-  it, which also provides the `hispec` CLI;
-- installs `hispec@.service` (then runs `daemon-reload`), the polkit rule, the
-  sudoers drop-in, `/usr/local/bin/hispec` and `/usr/local/sbin/hispec-enable`;
-- removes the retired `hispec-fei-start`, `hispec-fei-stop` and `hispec-doctor`
-  scripts (now `hispec start hsfei`, `hispec stop hsfei` and `hispec doctor`);
-- migrates any instance still running under the old `hispec-daemon@` name,
-  preserving whether it was enabled and whether it was up;
+- creates `/etc/hispec/secrets.env`, writable by `hispec-ops`, and records this
+  host's role in `/etc/hispec/host`;
+- renders `hispec@.service` (then runs `daemon-reload`), the polkit rule, the
+  sudoers drop-in, `/usr/local/bin/hispec` and `/usr/local/sbin/hispec-enable`
+  from `src/hispec/cli/instrument.toml`, reporting only what it changes;
 - lists instances that are deployed but not set to start at boot.
 
+Because those five are rendered rather than committed, `hispec doctor`
+compares what is installed against what `install` would write now, which is
+what catches a host whose unit predates a template change.
+
 `HISPEC_REPO_DIR` and `HISPEC_VENV_DIR` override the paths.
 
 `/usr/local/bin/hispec` is a tiny wrapper that runs the CLI from the venv. The
@@ -552,7 +557,8 @@ and `/var/log/hispec`; device nodes under `/dev` are unaffected by both.
 
 Starting and stopping a unit is the polkit action
 `org.freedesktop.systemd1.manage-units`, and systemd tells polkit which unit is
-involved, so `systemd/polkit/49-hispec.rules` can allow it for `hispec@*` and
+involved, so `/etc/polkit-1/rules.d/49-hispec.rules` can allow it for
+`hispec@*` and
 nothing else. Enabling and disabling is
 `org.freedesktop.systemd1.manage-unit-files`, and systemd does **not** pass a
 unit name with it. A polkit rule for it would grant `hispec-ops` enable/disable
diff --git a/pyproject.toml b/pyproject.toml
index 025e753..36e29d1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -33,7 +33,7 @@ dependencies = [
     # influxdb extra: needed by daemons/generic/keygrabber
     "libby[influxdb]@git+https://github.com/CaltechOpticalObservatories/libby.git",
     "hardware_device_base@git+https://github.com/COO-Utilities/hardware_device_base",
-    "instrumentctl@git+https://github.com/CaltechOpticalObservatories/instrumentctl.git",
+    "instrumentctl@git+https://github.com/CaltechOpticalObservatories/instrumentctl.git@v0.2.0",
     "camera_daemon@git+https://github.com/COO-Utilities/camera-daemon.git"
 ]
 
diff --git a/src/hispec/cli/instrument.toml b/src/hispec/cli/instrument.toml
index d656d31..2729b67 100644
--- a/src/hispec/cli/instrument.toml
+++ b/src/hispec/cli/instrument.toml
@@ -10,9 +10,10 @@
 
 [instrument]
 name = "hispec"
+display_name = "HISPEC"
 user = "hispec"
 ops_group = "hispec-ops"
-# Instance files set HISPEC_DAEMON, HISPEC_CONFIG and HISPEC_HOST
+# Instance files set HISPEC_DAEMON and HISPEC_HOST
 env_prefix = "HISPEC"
 docs_url = "https://caltechopticalobservatories.github.io/hispec/operations/systemd.html"
 
diff --git a/systemd/README.md b/systemd/README.md
index 73d1e3d..79d2778 100644
--- a/systemd/README.md
+++ b/systemd/README.md
@@ -11,12 +11,25 @@ directory.
 
 | Path | What it is |
 | --- | --- |
-| `hispec@.service` | The template unit. One file runs every daemon; `hispec@<name>` is an instance of it. Installed to `/etc/systemd/system/`. |
-| `instances/<name>.env` | Per-instance settings: `HISPEC_DAEMON` (script, relative to `daemons/`) and `HISPEC_CONFIG` (deployed config path). Deployed to `/etc/hispec/instances/`. |
-| `polkit/49-hispec.rules` | Lets `hispec-ops` members start/stop/restart `hispec@*` without sudo. Installed to `/etc/polkit-1/rules.d/`. |
-| `bin/hispec` | Wrapper that runs the `hispec` CLI from the venv. Installed to `/usr/local/bin/`. |
-| `bin/hispec-enable` | Root helper behind `hispec enable` / `hispec deploy`: enables/disables instances at boot, which `systemctl enable` cannot be granted per-unit. Installed to `/usr/local/sbin/`, invoked via `sudo -n` by a NOPASSWD drop-in. |
-| `install.sh` | Host setup for admins / IT: users, groups, directories, venv, and all of the above. Idempotent, run as root. Not needed to add a daemon. |
+| `instances/<name>.env` | Per-instance settings: `HISPEC_DAEMON` (script, relative to `daemons/`) and `HISPEC_HOST` (which host runs it). Deployed to `/etc/hispec/instances/`; the config path is derived as `/etc/hispec/<name>.yaml`. |
+| `install.sh` | Host setup for admins / IT. Bootstraps uv, builds the venv, then hands over to `hispec install`. Idempotent, run as root. Not needed to add a daemon. |
+
+`hispec install` writes the rest, rendered from
+`src/hispec/cli/instrument.toml`:
+
+| Installed | What it is |
+| --- | --- |
+| `/etc/systemd/system/hispec@.service` | The template unit. One file runs every daemon; `hispec@<name>` is an instance of it. |
+| `/etc/polkit-1/rules.d/49-hispec.rules` | Lets `hispec-ops` members start/stop/restart `hispec@*` without sudo. |
+| `/usr/local/bin/hispec` | Wrapper that runs the CLI from the venv. |
+| `/usr/local/sbin/hispec-enable` | Root helper behind `hispec enable` / `hispec deploy`: enables/disables instances at boot, which `systemctl enable` cannot be granted per-unit. Invoked via `sudo -n` by a NOPASSWD drop-in. |
+| `/etc/sudoers.d/hispec-ops` | That drop-in. |
+
+The templates live in
+[instrumentctl](https://github.com/CaltechOpticalObservatories/instrumentctl),
+so a change to the unit or the polkit rule is made there and reaches a host
+through `install.sh`. `hispec doctor` compares what is installed against what
+`install` would write now.
 
 ## Quick reference
 
diff --git a/systemd/bin/hispec b/systemd/bin/hispec
deleted file mode 100755
index 60e8383..0000000
--- a/systemd/bin/hispec
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-# Front door for the hispec CLI, installed to /usr/local/bin.
-#
-# The CLI itself lives in the venv, installed editable from the repo, so a
-# `git pull` updates it with no reinstall. This wrapper only exists so that a
-# missing or broken venv produces an instruction rather than "command not
-# found", since `hispec doctor` is exactly what people run when things break.
-
-VENV_DIR=${HISPEC_VENV_DIR:-/opt/hispec/venv}
-REPO_DIR=${HISPEC_REPO_DIR:-/opt/hispec/app}
-
-if [[ ! -x $VENV_DIR/bin/hispec ]]; then
-    echo "hispec: $VENV_DIR/bin/hispec is missing; the venv needs (re)installing." >&2
-    echo "  admin: sudo $REPO_DIR/systemd/install.sh" >&2
-    exit 1
-fi
-exec "$VENV_DIR/bin/hispec" "$@"
diff --git a/systemd/bin/hispec-enable b/systemd/bin/hispec-enable
deleted file mode 100755
index fc08789..0000000
--- a/systemd/bin/hispec-enable
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-# Enable (or disable) hispec@<instance> units at boot.
-#
-# `systemctl enable` needs the org.freedesktop.systemd1.manage-unit-files
-# polkit action, which polkit cannot scope to a single unit by name. Granting
-# it to hispec-ops would grant enable/disable on every unit on the host. This
-# helper is the narrow alternative: it runs as root via a sudoers drop-in that
-# is NOPASSWD for hispec-ops (see install.sh), and it only ever touches
-# hispec@<name> for a name that already has an instance file deployed.
-#
-# Operators normally reach it through `hispec enable` / `hispec deploy`, which
-# call it as `sudo -n hispec-enable ...`. It stays a standalone root-owned
-# script rather than part of the CLI because the CLI runs from the venv, which
-# the hispec user can write to, and root must not run code from there.
-#
-#   hispec-enable hsfei_adc hsfei_ms      # enable at boot (does not start)
-#   hispec-enable --now hsfei_adc         # enable and start
-#   hispec-enable --disable hsfei_adc     # disable at boot (does not stop)
-
-set -euo pipefail
-export PATH=/usr/sbin:/usr/bin:/sbin:/bin
-
-INSTANCE_DIR=/etc/hispec/instances
-
-verb=enable
-now=()
-
-usage() {
-    awk 'NR>1 && /^#/ {sub(/^# ?/, ""); print; next} NR>1 {exit}' "$0"
-    exit "${1:-0}"
-}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --disable) verb=disable; shift ;;
-        --now)     now=(--now); shift ;;
-        -h|--help) usage 0 ;;
-        --*)       echo "hispec-enable: unknown option $1" >&2; usage 1 ;;
-        *)         break ;;
-    esac
-done
-
-[[ $# -gt 0 ]] || usage 1
-
-# Validate before doing anything, so a typo in the third name does not leave
-# the first two half-applied.
-for name in "$@"; do
-    if [[ ! $name =~ ^[a-z][a-z0-9_]*$ ]]; then
-        echo "hispec-enable: refusing '$name': not a valid instance name" >&2
-        exit 1
-    fi
-    if [[ $verb == enable && ! -f "$INSTANCE_DIR/$name.env" ]]; then
-        echo "hispec-enable: no $INSTANCE_DIR/$name.env; deploy the instance file first" >&2
-        exit 1
-    fi
-done
-
-for name in "$@"; do
-    systemctl "$verb" ${now[@]+"${now[@]}"} "hispec@$name.service"
-done
diff --git a/systemd/hispec@.service b/systemd/hispec@.service
deleted file mode 100644
index c1a96f6..0000000
--- a/systemd/hispec@.service
+++ /dev/null
@@ -1,63 +0,0 @@
-# HISPEC hardware daemon: systemd template unit.
-#
-# This is a template: one file manages any daemons/<subdir>/<script>
-# that is a HispecDaemon subclass taking `-c <config.yaml>` and blocking in
-# daemon.serve()
-#
-# Instantiated per running daemon via the "%i" instance name, e.g.:
-#
-#   systemctl start hispec@hsfei_atcpress
-#   systemctl start hispec@hscal_gcellheater1
-#   systemctl start hispec@hscal_gcellheater2
-#
-# Each instance name maps to an EnvironmentFile at
-# /etc/hispec/instances/<instance>.env which says which daemon script to run
-# (HISPEC_DAEMON, as a path relative to daemons/, e.g. "generic/inficon" or
-# "hsfei/adc") and which config file to pass it (see systemd/instances/*.env
-# and docs/operations/systemd.md for setup instructions).
-
-[Unit]
-Description=HISPEC hardware daemon (%i)
-Documentation=https://caltechopticalobservatories.github.io/hispec/operations/systemd.html
-After=network-online.target
-Wants=network-online.target
-StartLimitIntervalSec=60
-StartLimitBurst=5
-
-[Service]
-Type=simple
-User=hispec
-Group=hispec
-
-EnvironmentFile=/etc/hispec/instances/%i.env
-# Optional, root-only, shared by every instance: for secrets that must not sit
-# in the instance files above, since /etc/hispec/instances is group-readable by
-# hispec-ops. systemd reads this as root before dropping to User= below.
-EnvironmentFile=-/etc/hispec/secrets.env
-# Drivers write their own .log next to the working directory, so this has to
-# be writable by User= above; the repo checkout is not
-WorkingDirectory=/var/log/hispec
-ExecStart=/opt/hispec/venv/bin/python3 /opt/hispec/app/daemons/${HISPEC_DAEMON} -c ${HISPEC_CONFIG}
-
-Restart=on-failure
-RestartSec=5
-TimeoutStopSec=10
-KillSignal=SIGTERM
-
-# The daemon logs to stderr/stdout unless its YAML config sets logging.file,
-# so by default everything lands in the journal:
-#   journalctl -u hispec@%i -f
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=hispec-%i
-
-# Basic sandboxing. Loosen ProtectSystem/ProtectHome if a driver needs write
-# access outside /etc/hispec, /var/log/hispec (e.g. a serial device node
-# under /dev is unaffected by these two).
-NoNewPrivileges=true
-ProtectSystem=full
-ProtectHome=true
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
diff --git a/systemd/install.sh b/systemd/install.sh
index 4b9c6de..35b8971 100755
--- a/systemd/install.sh
+++ b/systemd/install.sh
@@ -6,14 +6,17 @@
 #   sudo ./systemd/install.sh alice bob          # ... and enrol two operators
 #   sudo HISPEC_OPS_USERS="alice bob" ./systemd/install.sh   # same thing
 #
-# Re-run it to enrol operators, after a dependency or unit-file change, or to
-# repair a host. It is NOT part of adding a daemon: once a host is set up,
-# operators do that themselves with `hispec deploy <name>`, no root needed.
+# Re-run it to enrol operators, after a dependency change, or to repair a host.
+# It is NOT part of adding a daemon: once a host is set up, operators do that
+# themselves with `hispec deploy <name>`, no root needed.
 #
 # Operators named here are added to hispec-ops and systemd-journal, which is
 # what lets them start/stop/restart daemons and read logs without a password.
 # Skipping that step is the single most common reason systemctl keeps
 # prompting. See docs/operations/systemd.md.
+#
+# Everything past the virtualenv is `hispec install`, which lives in
+# instrumentctl and is shared with other instruments.
 
 set -euo pipefail
 
@@ -30,7 +33,7 @@ export UV_PROJECT_ENVIRONMENT="$VENV_DIR"
 
 # The daemons run as `hispec`, and this script runs as root, so a uv-managed
 # interpreter would land under root's home where they could not read it. Use
-# the system Python, as `python3 -m venv` did.
+# the system Python.
 export UV_NO_MANAGED_PYTHON=1
 
 if [[ $EUID -ne 0 ]]; then
@@ -46,68 +49,6 @@ if [[ ! -d "$REPO_DIR" ]]; then
     exit 1
 fi
 
-# hispec-ops: humans in this group can edit configs and start/stop/restart
-# hispec@* units without sudo (see systemd/polkit/*.rules). The hispec system
-# user joins it too, so it can read what operators write.
-if ! getent group hispec-ops &>/dev/null; then
-    groupadd --system hispec-ops
-    echo "created group 'hispec-ops'"
-fi
-
-# System user the daemons run as.
-if ! id hispec &>/dev/null; then
-    useradd --system --no-create-home --shell /usr/sbin/nologin -G hispec-ops hispec
-    echo "created system user 'hispec'"
-else
-    usermod -aG hispec-ops hispec
-fi
-
-# Operators. Doing this here rather than printing advice at the end is
-# deliberate: an operator who is not in hispec-ops gets a root password prompt
-# from every systemctl call, and has no way to tell that group membership is
-# the reason.
-for user in $OPS_USERS; do
-    if ! id "$user" &>/dev/null; then
-        echo "warning: no such user '$user', skipping" >&2
-        continue
-    fi
-    usermod -aG hispec-ops "$user"
-    if getent group systemd-journal &>/dev/null; then
-        usermod -aG systemd-journal "$user"
-    fi
-    echo "added '$user' to hispec-ops, systemd-journal (they must log out and back in)"
-done
-
-# Config/log directories. Setgid (2775/2750) so files created by any
-# hispec-ops member keep the group, instead of the creating user's own.
-install -d -o hispec -g hispec-ops -m 2775 /etc/hispec
-install -d -o hispec -g hispec-ops -m 2775 /etc/hispec/instances
-install -d -o hispec -g hispec-ops -m 2750 /var/log/hispec
-
-# Shared secrets, read by every unit if present. Group-readable rather than
-# root-only: requiring sudo for one file pushes people into putting credentials
-# in the instance files instead, which operators can already read.
-if [[ ! -e /etc/hispec/secrets.env ]]; then
-    cat > /etc/hispec/secrets.env <<'EOF'
-# Environment for every hispec@ instance. Keep credentials here rather than in
-# a config file, which is committed. `hispec doctor` lists the ones this host
-# needs and which daemon asks for each.
-EOF
-    echo "created /etc/hispec/secrets.env"
-fi
-chown root:hispec-ops /etc/hispec/secrets.env
-chmod 0660 /etc/hispec/secrets.env
-
-# This host's role, which instance files name so an instance cannot be
-# deployed onto the wrong machine. Pin it with HISPEC_HOST_ROLE when the
-# hostname is not what the instance files say.
-if [[ ! -e /etc/hispec/host ]]; then
-    echo "${HISPEC_HOST_ROLE:-$(hostname -s)}" > /etc/hispec/host
-    echo "recorded host role '$(cat /etc/hispec/host)' in /etc/hispec/host"
-fi
-chown root:hispec-ops /etc/hispec/host
-chmod 0644 /etc/hispec/host
-
 # Pinned, so re-running the installer cannot resolve with a different uv
 if [[ "$("$UV_BIN" --version 2>/dev/null)" != "uv $UV_VERSION"* ]]; then
     curl -LsSf "https://astral.sh/uv/$UV_VERSION/install.sh" |
@@ -115,10 +56,9 @@ if [[ "$("$UV_BIN" --version 2>/dev/null)" != "uv $UV_VERSION"* ]]; then
     echo "installed uv $UV_VERSION at $UV_BIN"
 fi
 
-# Python environment (editable install so `git pull` picks up code changes
-# without reinstalling). Upgrade the lock first: the git dependencies track
-# their default branch deliberately, and a reinstall is how a merged libby fix
-# reaches a host.
+# The virtualenv has to exist before the rest, since `hispec install` lives in
+# it. Upgrade the lock first: the git dependencies track their default branch
+# deliberately, and a reinstall is how a merged libby fix reaches a host.
 (
     cd "$REPO_DIR"
     "$UV_BIN" lock --upgrade
@@ -126,110 +66,6 @@ fi
     # the root project and leaves their dependencies out
     "$UV_BIN" sync --all-packages
 )
-chown -R hispec:hispec "$VENV_DIR"
-
-# Unit file + polkit rule (grants hispec-ops members start/stop/restart on
-# hispec@* without sudo).
-install -m 0644 "$REPO_DIR/systemd/hispec@.service" /etc/systemd/system/hispec@.service
-[[ -d /etc/polkit-1/rules.d ]] || install -d -m 0750 /etc/polkit-1/rules.d
-install -m 0644 "$REPO_DIR/systemd/polkit/49-hispec.rules" /etc/polkit-1/rules.d/49-hispec.rules
-
-# Operator commands. `hispec` is a thin wrapper around the CLI in the venv,
-# so the CLI follows `git pull` without a reinstall. hispec-enable is a copy,
-# not a link into the repo: it runs as root, so it must not be something the
-# hispec user or a `git pull` can change.
-install -d -m 0755 /usr/local/bin /usr/local/sbin
-install -m 0755 "$REPO_DIR/systemd/bin/hispec"        /usr/local/bin/hispec
-install -m 0755 "$REPO_DIR/systemd/bin/hispec-enable" /usr/local/sbin/hispec-enable
-# Retired in favour of `hispec start|stop|doctor`.
-rm -f /usr/local/bin/hispec-fei-start /usr/local/bin/hispec-fei-stop /usr/local/bin/hispec-doctor
-
-# Passwordless enable/disable, scoped to that one helper. Polkit cannot scope
-# manage-unit-files to a unit name, so `systemctl enable hispec@x` would
-# otherwise prompt for a password every time an instance is deployed.
-sudoers_tmp=$(mktemp)
-cat > "$sudoers_tmp" <<'EOF'
-# Installed by hispec systemd/install.sh. Lets hispec-ops members enable and
-# disable hispec@<instance> units at boot without a password. The helper
-# validates the instance name and refuses anything that is not a deployed
-# hispec instance, so this does not grant control of other units.
-%hispec-ops ALL=(root) NOPASSWD: /usr/local/sbin/hispec-enable
-EOF
-if visudo -cqf "$sudoers_tmp"; then
-    install -m 0440 -o root -g root "$sudoers_tmp" /etc/sudoers.d/hispec-ops
-else
-    echo "warning: generated sudoers file failed validation, not installing" >&2
-fi
-rm -f "$sudoers_tmp"
-
-systemctl daemon-reload
-
-# Migration: the template unit used to be called hispec-daemon@.service. Move
-# any instance that was enabled or running onto hispec@ and drop the old unit,
-# preserving whether it was enabled and whether it was up.
-if [[ -f /etc/systemd/system/hispec-daemon@.service ]]; then
-    echo
-    echo "migrating hispec-daemon@* instances to hispec@*"
-    old_instances=$(
-        {
-            systemctl list-units --all --no-legend --plain 'hispec-daemon@*.service' 2>/dev/null |
-                awk '{ print ($1 ~ /^hispec-daemon@/) ? $1 : $2 }'
-            find /etc/systemd/system -name 'hispec-daemon@*.service' -not -name 'hispec-daemon@.service' \
-                -printf '%f\n' 2>/dev/null
-        } | sort -u
-    )
-    for old_unit in $old_instances; do
-        name=${old_unit#hispec-daemon@}
-        name=${name%.service}
-        [[ -n $name ]] || continue
-        was_active=no
-        if systemctl is-active --quiet "$old_unit"; then was_active=yes; fi
-        was_enabled=no
-        if [[ $(systemctl is-enabled "$old_unit" 2>/dev/null) == enabled ]]; then was_enabled=yes; fi
-
-        systemctl disable --now "$old_unit" >/dev/null 2>&1 || true
-        if [[ $was_enabled == yes ]]; then systemctl enable "hispec@$name.service" >/dev/null; fi
-        if [[ $was_active == yes ]]; then systemctl start "hispec@$name.service" || true; fi
-        echo "  $name: enabled=$was_enabled active=$was_active -> hispec@$name"
-    done
-    rm -f /etc/systemd/system/hispec-daemon@.service
-    rm -f /etc/polkit-1/rules.d/49-hispec-daemons.rules
-    systemctl daemon-reload
-    echo "  removed hispec-daemon@.service and its polkit rule"
-fi
-
-echo
-echo "Host setup complete."
-
-# Report deployed-but-not-enabled instances rather than enabling them: whether
-# an instance should come up at boot is an operational decision, not ours.
-pending=""
-for env_file in /etc/hispec/instances/*.env; do
-    [[ -f $env_file ]] || continue
-    name=${env_file##*/}; name=${name%.env}
-    if [[ $(systemctl is-enabled "hispec@$name.service" 2>/dev/null) == enabled ]]; then
-        continue
-    fi
-    pending+=" $name"
-done
-if [[ -n $pending ]]; then
-    echo
-    echo "Deployed but not set to start at boot:$pending"
-    echo "  hispec enable --now$pending"
-fi
-
-cat <<EOF
-
-Operators in hispec-ops can now, with no password and no further install.sh:
-  - hispec deploy <name>          add a daemon (or: hispec deploy --new)
-  - hispec start|stop|restart <name|subsystem>
-  - hispec enable|disable <name>
-  - hispec status, hispec logs <name>
-  - edit /etc/hispec/*.yaml
-
-To enrol more operators later:
-  sudo $REPO_DIR/systemd/install.sh <username> ...
 
-If anything still asks for a password, run 'hispec doctor' as that user.
-Full instructions: docs/operations/systemd.md
-EOF
+# shellcheck disable=SC2086  # OPS_USERS is a deliberately word-split list
+exec "$VENV_DIR/bin/hispec" install $OPS_USERS
diff --git a/systemd/instances/hispec_keygrabber.env b/systemd/instances/hispec_keygrabber.env
index afa1714..434fe91 100644
--- a/systemd/instances/hispec_keygrabber.env
+++ b/systemd/instances/hispec_keygrabber.env
@@ -14,5 +14,4 @@
 # Needs libby's optional extra in the venv:
 #   /opt/hispec/venv/bin/pip install 'libby[influxdb]'
 HISPEC_DAEMON=generic/keygrabber
-HISPEC_CONFIG=/etc/hispec/hispec_keygrabber.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_gcellheater1.env b/systemd/instances/hscal_gcellheater1.env
index fc4ed11..cbb1480 100644
--- a/systemd/instances/hscal_gcellheater1.env
+++ b/systemd/instances/hscal_gcellheater1.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_gcellheater1.yaml to
 # /etc/hispec/hscal_gcellheater1.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/lakeshore
-HISPEC_CONFIG=/etc/hispec/hscal_gcellheater1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_gcellheater2.env b/systemd/instances/hscal_gcellheater2.env
index bc60c8d..e5ec06e 100644
--- a/systemd/instances/hscal_gcellheater2.env
+++ b/systemd/instances/hscal_gcellheater2.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_gcellheater2.yaml to
 # /etc/hispec/hscal_gcellheater2.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/lakeshore
-HISPEC_CONFIG=/etc/hispec/hscal_gcellheater2.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_hkcalfwheel1.env b/systemd/instances/hscal_hkcalfwheel1.env
index ffb1238..7e3cfaf 100644
--- a/systemd/instances/hscal_hkcalfwheel1.env
+++ b/systemd/instances/hscal_hkcalfwheel1.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_hkcalfwheel1.yaml to
 # /etc/hispec/hscal_hkcalfwheel1.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hscal_hkcalfwheel1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_hkcalfwheel2.env b/systemd/instances/hscal_hkcalfwheel2.env
index 02af8f0..02566cd 100644
--- a/systemd/instances/hscal_hkcalfwheel2.env
+++ b/systemd/instances/hscal_hkcalfwheel2.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_hkcalfwheel2.yaml to
 # /etc/hispec/hscal_hkcalfwheel2.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hscal_hkcalfwheel2.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_hketatten.env b/systemd/instances/hscal_hketatten.env
index c2f8e21..9339f77 100644
--- a/systemd/instances/hscal_hketatten.env
+++ b/systemd/instances/hscal_hketatten.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_hketatten.yaml to /etc/hispec/hscal_hketatten.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=hscal/smc8_attenuator
-HISPEC_CONFIG=/etc/hispec/hscal_hketatten.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_hkettherm.env b/systemd/instances/hscal_hkettherm.env
index aa91f64..e62be57 100644
--- a/systemd/instances/hscal_hkettherm.env
+++ b/systemd/instances/hscal_hkettherm.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_hkettherm.yaml to /etc/hispec/hscal_hkettherm.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/srsthermal
-HISPEC_CONFIG=/etc/hispec/hscal_hkettherm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_hkgcellfwheel.env b/systemd/instances/hscal_hkgcellfwheel.env
index 51add59..bcb3122 100644
--- a/systemd/instances/hscal_hkgcellfwheel.env
+++ b/systemd/instances/hscal_hkgcellfwheel.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_hkgcellfwheel.yaml to
 # /etc/hispec/hscal_hkgcellfwheel.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hscal_hkgcellfwheel.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_yjcalfwheel1.env b/systemd/instances/hscal_yjcalfwheel1.env
index df11d40..f3c74a0 100644
--- a/systemd/instances/hscal_yjcalfwheel1.env
+++ b/systemd/instances/hscal_yjcalfwheel1.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_yjcalfwheel1.yaml to
 # /etc/hispec/hscal_yjcalfwheel1.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hscal_yjcalfwheel1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_yjcalfwheel2.env b/systemd/instances/hscal_yjcalfwheel2.env
index 7f3e8b3..8be838b 100644
--- a/systemd/instances/hscal_yjcalfwheel2.env
+++ b/systemd/instances/hscal_yjcalfwheel2.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_yjcalfwheel2.yaml to
 # /etc/hispec/hscal_yjcalfwheel2.yaml, then enables and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hscal_yjcalfwheel2.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hscal_yjettherm.env b/systemd/instances/hscal_yjettherm.env
index b67bb1c..20e4bf3 100644
--- a/systemd/instances/hscal_yjettherm.env
+++ b/systemd/instances/hscal_yjettherm.env
@@ -6,5 +6,4 @@
 # config/hscal/hscal_yjettherm.yaml to /etc/hispec/hscal_yjettherm.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/srsthermal
-HISPEC_CONFIG=/etc/hispec/hscal_yjettherm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_adc.env b/systemd/instances/hsfei_adc.env
index dae60c7..15fe52c 100644
--- a/systemd/instances/hsfei_adc.env
+++ b/systemd/instances/hsfei_adc.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_adc.yaml to /etc/hispec/hsfei_adc.yaml, then enables and
 # starts the daemon.
 HISPEC_DAEMON=hsfei/adc
-HISPEC_CONFIG=/etc/hispec/hsfei_adc.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atccryo.env b/systemd/instances/hsfei_atccryo.env
index 7965b92..ddeedc7 100644
--- a/systemd/instances/hsfei_atccryo.env
+++ b/systemd/instances/hsfei_atccryo.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atccryo.yaml to /etc/hispec/hsfei_atccryo.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=hsfei/atccryo
-HISPEC_CONFIG=/etc/hispec/hsfei_atccryo.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atcfw.env b/systemd/instances/hsfei_atcfw.env
index b17ef1b..1f7ec6c 100644
--- a/systemd/instances/hsfei_atcfw.env
+++ b/systemd/instances/hsfei_atcfw.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atcfw.yaml to /etc/hispec/hsfei_atcfw.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=generic/filterwheel
-HISPEC_CONFIG=/etc/hispec/hsfei_atcfw.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atcl.env b/systemd/instances/hsfei_atcl.env
index 451edda..47c68f7 100644
--- a/systemd/instances/hsfei_atcl.env
+++ b/systemd/instances/hsfei_atcl.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atcl.yaml to /etc/hispec/hsfei_atcl.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=hsfei/pi-daemon
-HISPEC_CONFIG=/etc/hispec/hsfei_atcl.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atcp.env b/systemd/instances/hsfei_atcp.env
index 387268f..85ea8ad 100644
--- a/systemd/instances/hsfei_atcp.env
+++ b/systemd/instances/hsfei_atcp.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atcp.yaml to /etc/hispec/hsfei_atcp.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=hsfei/pi-daemon
-HISPEC_CONFIG=/etc/hispec/hsfei_atcp.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atcpress.env b/systemd/instances/hsfei_atcpress.env
index 5e76c0e..9ace759 100644
--- a/systemd/instances/hsfei_atcpress.env
+++ b/systemd/instances/hsfei_atcpress.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atcpress.yaml to /etc/hispec/hsfei_atcpress.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/inficon
-HISPEC_CONFIG=/etc/hispec/hsfei_atcpress.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_atctherm.env b/systemd/instances/hsfei_atctherm.env
index 573b617..120c2b7 100644
--- a/systemd/instances/hsfei_atctherm.env
+++ b/systemd/instances/hsfei_atctherm.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_atctherm.yaml to /etc/hispec/hsfei_atctherm.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/lakeshore
-HISPEC_CONFIG=/etc/hispec/hsfei_atctherm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_feipo.env b/systemd/instances/hsfei_feipo.env
index 9588a92..f249cb7 100644
--- a/systemd/instances/hsfei_feipo.env
+++ b/systemd/instances/hsfei_feipo.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_feipo.yaml to /etc/hispec/hsfei_feipo.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=hsfei/pi-daemon
-HISPEC_CONFIG=/etc/hispec/hsfei_feipo.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_hkfam.env b/systemd/instances/hsfei_hkfam.env
index 2c438d9..542ed45 100644
--- a/systemd/instances/hsfei_hkfam.env
+++ b/systemd/instances/hsfei_hkfam.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_hkfam.yaml to /etc/hispec/hsfei_hkfam.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=hsfei/xeryon
-HISPEC_CONFIG=/etc/hispec/hsfei_hkfam.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_lsm.env b/systemd/instances/hsfei_lsm.env
index 03ea28d..5893062 100644
--- a/systemd/instances/hsfei_lsm.env
+++ b/systemd/instances/hsfei_lsm.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_lsm.yaml to /etc/hispec/hsfei_lsm.yaml, then enables and
 # starts the daemon.
 HISPEC_DAEMON=hsfei/pi-daemon
-HISPEC_CONFIG=/etc/hispec/hsfei_lsm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_ms.env b/systemd/instances/hsfei_ms.env
index be731c4..87f1ede 100644
--- a/systemd/instances/hsfei_ms.env
+++ b/systemd/instances/hsfei_ms.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_ms.yaml to /etc/hispec/hsfei_ms.yaml, then enables and
 # starts the daemon.
 HISPEC_DAEMON=hsfei/pi-daemon
-HISPEC_CONFIG=/etc/hispec/hsfei_ms.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_piaadeploy.env b/systemd/instances/hsfei_piaadeploy.env
index 3176f93..db8f574 100644
--- a/systemd/instances/hsfei_piaadeploy.env
+++ b/systemd/instances/hsfei_piaadeploy.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_piaadeploy.yaml to /etc/hispec/hsfei_piaadeploy.yaml,
 # then enables and starts the daemon.
 HISPEC_DAEMON=hsfei/xeryon
-HISPEC_CONFIG=/etc/hispec/hsfei_piaadeploy.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_piaagimb.env b/systemd/instances/hsfei_piaagimb.env
index 8eb8962..7903c5b 100644
--- a/systemd/instances/hsfei_piaagimb.env
+++ b/systemd/instances/hsfei_piaagimb.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_piaagimb.yaml to /etc/hispec/hsfei_piaagimb.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=hsfei/piaa-gimbalmount
-HISPEC_CONFIG=/etc/hispec/hsfei_piaagimb.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_piaagimr.env b/systemd/instances/hsfei_piaagimr.env
index 8e6699c..ab55622 100644
--- a/systemd/instances/hsfei_piaagimr.env
+++ b/systemd/instances/hsfei_piaagimr.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_piaagimr.yaml to /etc/hispec/hsfei_piaagimr.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=hsfei/piaa-gimbalmount
-HISPEC_CONFIG=/etc/hispec/hsfei_piaagimr.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsfei_yjfam.env b/systemd/instances/hsfei_yjfam.env
index d90f725..20c9fda 100644
--- a/systemd/instances/hsfei_yjfam.env
+++ b/systemd/instances/hsfei_yjfam.env
@@ -6,5 +6,4 @@
 # config/hsfei/hsfei_yjfam.yaml to /etc/hispec/hsfei_yjfam.yaml, then enables
 # and starts the daemon.
 HISPEC_DAEMON=hsfei/xeryon
-HISPEC_CONFIG=/etc/hispec/hsfei_yjfam.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hshk_hkdettherm.env b/systemd/instances/hshk_hkdettherm.env
index b0b07da..9c5d829 100644
--- a/systemd/instances/hshk_hkdettherm.env
+++ b/systemd/instances/hshk_hkdettherm.env
@@ -6,5 +6,4 @@
 # config/hshk/hshk_hkdettherm.yaml to /etc/hispec/hshk_hkdettherm.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/lakeshore
-HISPEC_CONFIG=/etc/hispec/hshk_hkdettherm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hshk_hkpress.env b/systemd/instances/hshk_hkpress.env
index 2f50bba..541a5d6 100644
--- a/systemd/instances/hshk_hkpress.env
+++ b/systemd/instances/hshk_hkpress.env
@@ -6,5 +6,4 @@
 # config/hshk/hshk_hkpress.yaml to /etc/hispec/hshk_hkpress.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/inficon
-HISPEC_CONFIG=/etc/hispec/hshk_hkpress.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_bspec1.env b/systemd/instances/hspower_bspec1.env
index 55f138b..67c8fc5 100644
--- a/systemd/instances/hspower_bspec1.env
+++ b/systemd/instances/hspower_bspec1.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_bspec1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_cal1.env b/systemd/instances/hspower_cal1.env
index 63972a5..65da6d2 100644
--- a/systemd/instances/hspower_cal1.env
+++ b/systemd/instances/hspower_cal1.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_cal1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_cal2.env b/systemd/instances/hspower_cal2.env
index 9cf4ced..b4f3693 100644
--- a/systemd/instances/hspower_cal2.env
+++ b/systemd/instances/hspower_cal2.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_cal2.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_cal3.env b/systemd/instances/hspower_cal3.env
index 64a5af0..4fd2dd1 100644
--- a/systemd/instances/hspower_cal3.env
+++ b/systemd/instances/hspower_cal3.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_cal3.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_cal4.env b/systemd/instances/hspower_cal4.env
index 940c6e3..5346df1 100644
--- a/systemd/instances/hspower_cal4.env
+++ b/systemd/instances/hspower_cal4.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_cal4.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_fei1.env b/systemd/instances/hspower_fei1.env
index b109a1b..a44063d 100644
--- a/systemd/instances/hspower_fei1.env
+++ b/systemd/instances/hspower_fei1.env
@@ -10,5 +10,4 @@
 # in root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/dli_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_fei1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_fei2.env b/systemd/instances/hspower_fei2.env
index 343f767..c1d804e 100644
--- a/systemd/instances/hspower_fei2.env
+++ b/systemd/instances/hspower_fei2.env
@@ -10,5 +10,4 @@
 # in root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/dli_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_fei2.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_fei3.env b/systemd/instances/hspower_fei3.env
index 1ce944b..da21c18 100644
--- a/systemd/instances/hspower_fei3.env
+++ b/systemd/instances/hspower_fei3.env
@@ -10,5 +10,4 @@
 # in root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_fei3.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_fei4.env b/systemd/instances/hspower_fei4.env
index 297309a..332c22e 100644
--- a/systemd/instances/hspower_fei4.env
+++ b/systemd/instances/hspower_fei4.env
@@ -10,5 +10,4 @@
 # in root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_fei4.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_fib1.env b/systemd/instances/hspower_fib1.env
index 3b255d6..8d079cc 100644
--- a/systemd/instances/hspower_fib1.env
+++ b/systemd/instances/hspower_fib1.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_fib1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hspower_rspec1.env b/systemd/instances/hspower_rspec1.env
index c0193c8..f83b4fb 100644
--- a/systemd/instances/hspower_rspec1.env
+++ b/systemd/instances/hspower_rspec1.env
@@ -10,5 +10,4 @@
 # root-only /etc/hispec/secrets.env, not from here: this file is readable by
 # every hispec-ops member.
 HISPEC_DAEMON=hspower/eaton_pdu
-HISPEC_CONFIG=/etc/hispec/hspower_rspec1.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsyj_yjdettherm.env b/systemd/instances/hsyj_yjdettherm.env
index 2ecd3a6..e8a6fb6 100644
--- a/systemd/instances/hsyj_yjdettherm.env
+++ b/systemd/instances/hsyj_yjdettherm.env
@@ -6,5 +6,4 @@
 # config/hsyj/hsyj_yjdettherm.yaml to /etc/hispec/hsyj_yjdettherm.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/lakeshore
-HISPEC_CONFIG=/etc/hispec/hsyj_yjdettherm.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/instances/hsyj_yjpress.env b/systemd/instances/hsyj_yjpress.env
index 39f0e60..50f732c 100644
--- a/systemd/instances/hsyj_yjpress.env
+++ b/systemd/instances/hsyj_yjpress.env
@@ -6,5 +6,4 @@
 # config/hsyj/hsyj_yjpress.yaml to /etc/hispec/hsyj_yjpress.yaml, then
 # enables and starts the daemon.
 HISPEC_DAEMON=generic/inficon
-HISPEC_CONFIG=/etc/hispec/hsyj_yjpress.yaml
 HISPEC_HOST=hispecserver
diff --git a/systemd/polkit/49-hispec.rules b/systemd/polkit/49-hispec.rules
deleted file mode 100644
index 5a1ec94..0000000
--- a/systemd/polkit/49-hispec.rules
+++ /dev/null
@@ -1,19 +0,0 @@
-// Let members of the "hispec-ops" group start/stop/restart hispec@* units
-// without sudo, while leaving every other systemd unit on the host alone.
-//
-// Install as /etc/polkit-1/rules.d/49-hispec.rules (picked up automatically
-// by polkit, no restart needed). Requires root to install; see install.sh.
-//
-// Note: this only covers org.freedesktop.systemd1.manage-units (start,
-// stop, restart, kill, reset-failed). Polkit cannot scope
-// manage-unit-files (enable/disable) to a single unit by name, so those go
-// through the hispec-enable helper and its sudoers drop-in instead.
-polkit.addRule(function(action, subject) {
-    if (action.id == "org.freedesktop.systemd1.manage-units" &&
-        subject.isInGroup("hispec-ops")) {
-        var unit = action.lookup("unit");
-        if (unit && unit.indexOf("hispec@") == 0) {
-            return polkit.Result.YES;
-        }
-    }
-});