diff --git a/deploy/install.sh b/deploy/install.sh
index 06561b3..c780266 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -33,6 +33,7 @@ install -d -m 0755 -o rollcall -g rollcall /var/lib/rollcall/dnsmasq
 install -m 0644 rollcall-dnsmasq.path rollcall-dnsmasq.service /etc/systemd/system/
 # optional: this host is also the Slurm controller -> keep its slurm.conf rendered from the profile
 install -m 0644 rollcall-controller-sync.service rollcall-controller-sync.timer /etc/systemd/system/
+install -m 0755 rollcall-controller-sync.sh /usr/local/bin/rollcall-controller-sync.sh
 systemctl daemon-reload
 systemctl enable --now rollcall-dnsmasq.path >/dev/null 2>&1 || true
 if systemctl list-unit-files slurmctld.service >/dev/null 2>&1 && [ -d /etc/slurm ]; then
diff --git a/deploy/rollcall-controller-sync.service b/deploy/rollcall-controller-sync.service
index 94eb4b4..8858f71 100644
--- a/deploy/rollcall-controller-sync.service
+++ b/deploy/rollcall-controller-sync.service
@@ -6,7 +6,4 @@ After=rollcall.service
 Type=oneshot
 # PROFILE is the profile whose overlay carries slurm.conf
 Environment=PROFILE=compute
-ExecStart=/bin/sh -c 'set -e; new=$(/usr/local/bin/rollcall render "$PROFILE" etc/slurm/slurm.conf) || exit 0; \
-  if ! printf "%%s\n" "$new" | grep -v "^# rendered by rollcall" | cmp -s - <(grep -v "^# rendered by rollcall" /etc/slurm/slurm.conf 2>/dev/null); then \
-    printf "%%s\n" "$new" > /etc/slurm/slurm.conf.new && mv /etc/slurm/slurm.conf.new /etc/slurm/slurm.conf; \
-    systemctl try-restart slurmctld.service; echo "slurm.conf updated"; fi'
+ExecStart=/usr/local/bin/rollcall-controller-sync.sh
diff --git a/deploy/rollcall-controller-sync.sh b/deploy/rollcall-controller-sync.sh
new file mode 100755
index 0000000..9aaee25
--- /dev/null
+++ b/deploy/rollcall-controller-sync.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Render the profile's slurm.conf and, when it differs from the local one,
+# install it and restart slurmctld. Runs from rollcall-controller-sync.timer.
+set -eu
+PROFILE=${PROFILE:-compute}
+CONF=/etc/slurm/slurm.conf
+new=$(mktemp)
+trap 'rm -f "$new"' EXIT
+/usr/local/bin/rollcall render "$PROFILE" etc/slurm/slurm.conf > "$new" || exit 0
+if [ -f "$CONF" ] && grep -v '^# rendered by rollcall' "$new" | cmp -s - "$(grep -v '^# rendered by rollcall' "$CONF" > "$new.old" && echo "$new.old")"; then
+  rm -f "$new.old"
+  exit 0
+fi
+rm -f "$new.old"
+install -m 0644 "$new" "$CONF"
+systemctl try-restart slurmctld.service
+echo "slurm.conf updated"