diff --git a/hook/setup.go b/hook/setup.go
--- a/hook/setup.go
+++ b/hook/setup.go
@@ -36,6 +36,14 @@
 	}
 }
 
+func Config(opts ...setupOpt) config {
+	config := config{}
+	for _, o := range opts {
+		o(&config)
+	}
+	return config
+}
+
 // setup hooks for all users
 //
 // directory structure is typically like so:
@@ -43,11 +51,7 @@
 //	did:plc:foobar/repo1
 //	did:plc:foobar/repo2
 //	did:web:barbaz/repo1
-func Setup(opts ...setupOpt) error {
-	config := config{}
-	for _, o := range opts {
-		o(&config)
-	}
+func Setup(config config) error {
 	// iterate over all directories in current directory:
 	userDirs, err := os.ReadDir(config.scanPath)
 	if err != nil {
@@ -65,7 +69,7 @@
 		}
 
 		userPath := filepath.Join(config.scanPath, did)
-		if err := setupUser(&config, userPath); err != nil {
+		if err := SetupUser(config, userPath); err != nil {
 			return err
 		}
 	}
@@ -74,7 +78,7 @@
 }
 
 // setup hooks in /scanpath/did:plc:user
-func setupUser(config *config, userPath string) error {
+func SetupUser(config config, userPath string) error {
 	repos, err := os.ReadDir(userPath)
 	if err != nil {
 		return err
@@ -86,7 +90,7 @@
 		}
 
 		path := filepath.Join(userPath, repo.Name())
-		if err := setup(config, path); err != nil {
+		if err := SetupRepo(config, path); err != nil {
 			if errors.Is(err, ErrNoGitRepo) {
 				continue
 			}
@@ -98,7 +102,7 @@
 }
 
 // setup hook in /scanpath/did:plc:user/repo
-func setup(config *config, path string) error {
+func SetupRepo(config config, path string) error {
 	if _, err := git.PlainOpen(path); err != nil {
 		return fmt.Errorf("%s: %w", path, ErrNoGitRepo)
 	}
@@ -121,7 +125,7 @@
 	return nil
 }
 
-func mkHook(config *config, hookPath string) error {
+func mkHook(config config, hookPath string) error {
 	executablePath, err := os.Executable()
 	if err != nil {
 		return err
diff --git a/knotserver/routes.go b/knotserver/routes.go
--- a/knotserver/routes.go
+++ b/knotserver/routes.go
@@ -26,6 +26,7 @@
 	gogit "github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
+	"tangled.sh/tangled.sh/core/hook"
 	"tangled.sh/tangled.sh/core/knotserver/db"
 	"tangled.sh/tangled.sh/core/knotserver/git"
 	"tangled.sh/tangled.sh/core/patchutil"
@@ -669,6 +670,18 @@
 	err = h.e.AddRepo(did, ThisServer, relativeRepoPath)
 	if err != nil {
 		l.Error("adding repo permissions", "error", err.Error())
+		writeError(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	err = hook.SetupRepo(hook.Config(
+		hook.WithScanPath(h.c.Repo.ScanPath),
+		hook.WithInternalApi(h.c.Server.InternalListenAddr),
+	),
+		repoPath,
+	)
+	if err != nil {
+		l.Error("setting up hooks", "error", err.Error())
 		writeError(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
diff --git a/knotserver/server.go b/knotserver/server.go
--- a/knotserver/server.go
+++ b/knotserver/server.go
@@ -47,10 +47,10 @@
 		return fmt.Errorf("failed to load config: %w", err)
 	}
 
-	err = hook.Setup(
+	err = hook.Setup(hook.Config(
 		hook.WithScanPath(c.Repo.ScanPath),
 		hook.WithInternalApi(c.Server.InternalListenAddr),
-	)
+	))
 	if err != nil {
 		return fmt.Errorf("failed to setup hooks: %w", err)
 	}
diff --git a/nix/vm.nix b/nix/vm.nix
--- a/nix/vm.nix
+++ b/nix/vm.nix
@@ -21,7 +21,7 @@
         g = config.services.tangled-knot.gitUser;
       in [
         "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first
-        "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=38a7c3237c2a585807e06a5bcfac92eb39442063f3da306b7acb15cfdc51d19d"
+        "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=40b4db20544e37a12ba3ed7353d4d4421a30e0593385068d2ef85263495794d8"
       ];
       services.tangled-knot = {
         enable = true;