diff --git a/keycloak.yaml b/keycloak.yaml
index 0f4ed34..d34f3b0 100644
--- a/keycloak.yaml
+++ b/keycloak.yaml
@@ -38,6 +38,7 @@ services:
         - ./data/keycloak/certs:/etc/x509/https
         - ./data/keycloak/keycloak:/opt/keycloak/data
         - ./keycloak/client-create:/bin/client-create:ro
+        - ./keycloak/client-get:/bin/client-get:ro
         - ./keycloak/create-user:/bin/create-user:ro
         - ./keycloak/remind-user:/bin/remind-user:ro
         - ./keycloak/keycloak-login.sh:/bin/keycloak-login.sh:ro
diff --git a/keycloak/client-create b/keycloak/client-create
index cf6beab..21e2f62 100755
--- a/keycloak/client-create
+++ b/keycloak/client-create
@@ -5,22 +5,19 @@ client_name="$1"
 hostname="$2"
 secret="$3"
 
-client_id="$(kcadm.sh get clients \
-	-r "$REALM" \
-	--fields id \
-	-q clientId="$client_name" \
-	--format csv \
-	--noquotes \
-)"
+client_id="$(client-get $client_name)"
 
 if [ -n "$client_id" ]; then
-	kcadm.sh delete "clients/$client_id" -r "$REALM" || die "$client_id: unable to delete"
+	#kcadm.sh delete "clients/$client_id" -r "$REALM" || die "$client_id: unable to delete"
+	echo >&2 "$client_name: $client_id already exists"
+	echo "$client_id"
+	exit 0
 fi
 
 # remember to add a leading , if adding extra data
 extra="$(cat -)"
 
-kcadm.sh create clients -r "$REALM"  -f - <<EOF || die "$client_id: unable to create"
+kcadm.sh create clients -r "$REALM"  -f - <<EOF || die "$client_name: unable to create"
 {
 	"clientId": "$client_name",
 	"rootUrl": "https://$hostname",
@@ -32,3 +29,7 @@ kcadm.sh create clients -r "$REALM"  -f - <<EOF || die "$client_id: unable to cr
 	$extra
 }
 EOF
+
+client_id=$(client-get "$client_name")
+echo >&2 "$client_name: $client_id created"
+echo "$client_id"
diff --git a/keycloak/client-get b/keycloak/client-get
new file mode 100755
index 0000000..80d86e7
--- /dev/null
+++ b/keycloak/client-get
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+client_name="$1"
+if [ -z "$client_name" ]; then
+	echo >&2 "usage: $0 client-name"
+	exit 1
+fi
+
+kcadm.sh get clients \
+	-r "$REALM" \
+	-q "clientId=$client_name" \
+	--fields id \
+	--format csv \
+	--noquotes
diff --git a/mastodon/keycloak.sh b/mastodon/keycloak.sh
index 389eb61..4766fcb 100755
--- a/mastodon/keycloak.sh
+++ b/mastodon/keycloak.sh
@@ -1,3 +1,6 @@
 #!/bin/bash -x
 
-client-create mastodon "$MASTODON_HOSTNAME.$DOMAIN_NAME" "$MASTODON_CLIENT_SECRET" </dev/null
+client_id=$(client-create mastodon "$MASTODON_HOSTNAME.$DOMAIN_NAME" "$MASTODON_CLIENT_SECRET" </dev/null)
+
+echo '{"name":"admin"}' | kcadm.sh create -r "$REALM" "clients/$client_id/roles" -f -
+echo '{"name":"moderator"}' | kcadm.sh create -r "$REALM" "clients/$client_id/roles" -f -
diff --git a/pixelfed/keycloak.sh b/pixelfed/keycloak.sh
index b036a48..66b19da 100755
--- a/pixelfed/keycloak.sh
+++ b/pixelfed/keycloak.sh
@@ -1,2 +1,4 @@
 #!/bin/bash -x
-client-create pixelfed "$PIXELFED_HOSTNAME.$DOMAIN_NAME" "$PIXELFED_CLIENT_SECRET" </dev/null
+client_id=$(client-create pixelfed "$PIXELFED_HOSTNAME.$DOMAIN_NAME" "$PIXELFED_CLIENT_SECRET" </dev/null)
+
+echo '{"name":"admin"}' | kcadm.sh create -r "$REALM" "clients/$client_id/roles" -f -