diff --git a/imagesets/docker/Dockerfile b/docker/Dockerfile
similarity index 100%
rename from imagesets/docker/Dockerfile
rename to docker/Dockerfile
diff --git a/imagesets/docker/TAG b/docker/TAG
similarity index 100%
rename from imagesets/docker/TAG
rename to docker/TAG
diff --git a/imagesets/docker/build.sh b/docker/build.sh
similarity index 100%
rename from imagesets/docker/build.sh
rename to docker/build.sh
diff --git a/imagesets/README.md b/imagesets/README.md
index 4a50a63c..8d2377a2 100644
--- a/imagesets/README.md
+++ b/imagesets/README.md
@@ -125,36 +125,8 @@ complete:
    updating image references in `/config/imagesets.yml`. Make sure to push this
    commit upstream (i.e. to `git@github.com:mozilla/community-tc-config.git`).
 
-2) Apply the config changes by running `tc-admin`. Note, here is a script that
-   does this, if you have not already set something up:
-
-
-   ```bash
-   #!/bin/bash -e
-   rm -rf tc-admin
-   mkdir tc-admin
-   pip3 install --upgrade pip
-   cd tc-admin
-   python3 -m venv tc-admin-venv
-   source tc-admin-venv/bin/activate
-   pip3 install pytest
-   pip3 install --upgrade pip
-   git clone https://github.com/mozilla/community-tc-config
-   cd community-tc-config
-   pip3 install -e .
-   which tc-admin
-   pass git pull
-   TASKCLUSTER_ROOT_URL=https://community-tc.services.mozilla.com tc-admin diff || true
-   echo
-   echo 'Applying in 60 seconds (Ctrl-C to abort)....'
-   echo
-   sleep 60
-   echo 'Applying!'
-   echo
-   TASKCLUSTER_ROOT_URL=https://community-tc.services.mozilla.com tc-admin apply
-   cd ../..
-   rm -rf tc-admin
-   ```
+2) Apply the config changes by running `run-tc-admin.sh` in the root folder of
+   this repository.
 
 3) Don't forget to test your image set changes! Try rerunning some tasks that
    previously ran successfully.
diff --git a/imagesets/imageset.sh b/imagesets/imageset.sh
index 4ea61d71..ee8ecf7f 100755
--- a/imagesets/imageset.sh
+++ b/imagesets/imageset.sh
@@ -186,7 +186,8 @@ function deploy {
   git push "${OFFICIAL_GIT_REPO}" "+HEAD:refs/heads/main"
   log 'Deployment of image sets successful!'
   log ''
-  log 'Be sure to run tc-admin in the community-tc-config repo to apply changes to the community cluster!'
+  cd ../..
+  log 'Be sure to run tc-admin to apply changes to the community cluster!'" There is a utility script for doing this: $(pwd)/run-tc-admin.sh"
 }
 
 ################## AWS ##################
diff --git a/run-tc-admin.sh b/run-tc-admin.sh
new file mode 100755
index 00000000..d8ce1309
--- /dev/null
+++ b/run-tc-admin.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+set -eu
+set -o pipefail
+
+function tc_admin {
+
+
+  ################################################
+  # this is temporarily in here while i work out what is needed, then it will be moved into docker image itself...
+  apt update
+  apt install -y python3-pip python3.8-venv
+  pip install --upgrade pip
+  python3 -m venv tc-admin-venv
+  pip3 install pytest
+  pip3 install --upgrade pip
+  ################################################
+
+
+  source tc-admin-venv/bin/activate
+  export TEMP_DIR="$(mktemp -d -t password-store.XXXXXXXXXX)"
+  export PASSWORD_STORE_DIR="${TEMP_DIR}/.password-store"
+  cd "${TEMP_DIR}"
+  git clone https://github.com/mozilla/community-tc-config
+  cd community-tc-config
+  pip3 install -e .
+  which tc-admin
+  git clone ssh://gitolite3@git-internal.mozilla.org/taskcluster/secrets.git "${PASSWORD_STORE_DIR}"
+  export TASKCLUSTER_ROOT_URL='https://community-tc.services.mozilla.com'
+  export TASKCLUSTER_CLIENT_ID='static/taskcluster/root'
+  export TASKCLUSTER_ACCESS_TOKEN="$(pass show community-tc/root | head -n 1)"
+  unset TASKCLUSTER_CERTIFICATE
+  tc-admin diff || true
+  tc-admin diff --ids-only || true
+  echo
+  done=false
+  while true; do
+    read -p "Apply changes (yes/no)? " choice
+    case "${choice}" in
+      yes)
+        echo
+        echo 'Applying!'
+        echo
+        tc-admin apply
+        break
+        ;;
+      no)
+        echo "Ok, ok, 🐥."
+        break
+        ;;
+      *)
+        echo "Invalid response: '${choice}'. Please answer 'yes' or 'no'."
+        ;;
+    esac
+  done
+  cd
+  rm -rf "${TEMP_DIR}"
+}
+
+################## Entry point ##################
+
+cd "$(dirname "${0}")"
+
+if [ "${1-}" == "native" ]; then
+  tc_admin
+else
+  TAG="$(cat docker/TAG)"
+  docker run \
+    --rm \
+    -ti \
+    -v "$(pwd):/community-tc-config" \
+    -v ~/.config:/root/.config \
+    -v ~/.gitconfig:/root/.gitconfig \
+    -v ~/.gnupg:/root/.gnupg \
+    -v ~/.ssh:/root/.ssh \
+    "${TAG}" \
+    /community-tc-config/run-tc-admin.sh native
+fi