diff --git a/pi/bin/roverd-self-update.sh b/pi/bin/roverd-self-update.sh
index 4f43e541..2afc0167 100755
--- a/pi/bin/roverd-self-update.sh
+++ b/pi/bin/roverd-self-update.sh
@@ -29,6 +29,15 @@ if [[ "${EUID}" -ne 0 ]]; then
 	exit 1
 fi
 
+if [[ "${ROVERD_SELF_UPDATE_SYSTEMD:-}" != "1" ]] && command -v systemd-run >/dev/null 2>&1; then
+	exec systemd-run \
+		--unit=roverd-self-update \
+		--collect \
+		--property=Type=exec \
+		--setenv=ROVERD_SELF_UPDATE_SYSTEMD=1 \
+		"$0"
+fi
+
 if [[ ! -f "$ENV_FILE" ]]; then
 	echo "Missing $ENV_FILE; run pi/install_roverd.sh once to register the repository path" >&2
 	exit 1
diff --git a/plans/toggleable bandwidth savings.md b/plans/toggleable bandwidth savings.md
index 11e03dba..97b7cff5 100644
--- a/plans/toggleable bandwidth savings.md	
+++ b/plans/toggleable bandwidth savings.md	
@@ -13,4 +13,5 @@
 - external spectator access (new)
   - off (no one can access the spectate page externally)
   - on (everyone can access the spectate page externally)
+  - admin (external spectators get mode gate overlay, when logged in once that identity gets spectator access forever. use database.)
 - anything else related to bandwidth savings should also get config
\ No newline at end of file