diff --git a/Gitea.App/Gitea.App.fsproj b/Gitea.App/Gitea.App.fsproj
index f74ccb4..9a4258c 100644
--- a/Gitea.App/Gitea.App.fsproj
+++ b/Gitea.App/Gitea.App.fsproj
@@ -14,6 +14,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="Argu" Version="6.1.1" />
     <PackageReference Include="Microsoft.Extensions.Logging.Console" Version="7.0.0" />
   </ItemGroup>
 
diff --git a/Gitea.App/Program.fs b/Gitea.App/Program.fs
index 6b001a3..ca9d009 100644
--- a/Gitea.App/Program.fs
+++ b/Gitea.App/Program.fs
@@ -6,6 +6,30 @@ open System.Net.Http
 open Microsoft.Extensions.Logging
 open Microsoft.Extensions.Logging.Console
 open Microsoft.Extensions.Options
+open Argu
+
+type ArgsFragments =
+    | [<ExactlyOnce ; EqualsAssignmentOrSpaced>] Config_File of string
+    | [<ExactlyOnce ; EqualsAssignmentOrSpaced>] Gitea_Host of string
+    | [<ExactlyOnce ; EqualsAssignmentOrSpaced>] Gitea_Admin_Api_Token of string
+    | [<Unique ; EqualsAssignmentOrSpaced>] GitHub_Api_Token of string
+
+    interface IArgParserTemplate with
+        member s.Usage =
+            match s with
+            | Config_File _ ->
+                "a config file, JSON, conforming to GiteaConfig.schema.json, specifying the desired Gitea configuration"
+            | Gitea_Host _ -> "the Gitea host, e.g. https://gitea.mydomain.com"
+            | Gitea_Admin_Api_Token _ -> "a Gitea admin user's API token"
+            | GitHub_Api_Token _ -> "a GitHub API token with read access to every desired sync-from-GitHub repo"
+
+type Args =
+    {
+        ConfigFile : FileInfo
+        GiteaHost : Uri
+        GiteaAdminApiToken : string
+        GitHubApiToken : string option
+    }
 
 module Program =
 
@@ -129,13 +153,18 @@ module Program =
 
     [<EntryPoint>]
     let main argv =
-        let configFile, giteaHost, giteaApiToken, githubApiToken =
-            match argv with
-            | [| f ; giteaHost ; giteaToken |] -> FileInfo f, Uri giteaHost, giteaToken, None
-            | [| f ; giteaHost ; giteaToken ; githubToken |] -> FileInfo f, Uri giteaHost, giteaToken, Some githubToken
-            | _ -> failwithf $"malformed args: %+A{argv}"
+        let parser = ArgumentParser.Create<ArgsFragments> ()
+        let parsed = parser.Parse argv
 
-        let config = GiteaConfig.get configFile
+        let args =
+            {
+                ConfigFile = parsed.GetResult ArgsFragments.Config_File |> FileInfo
+                GiteaHost = parsed.GetResult ArgsFragments.Gitea_Host |> Uri
+                GiteaAdminApiToken = parsed.GetResult ArgsFragments.Gitea_Admin_Api_Token
+                GitHubApiToken = parsed.TryGetResult ArgsFragments.GitHub_Api_Token
+            }
+
+        let config = GiteaConfig.get args.ConfigFile
 
         let options =
             let options = ConsoleLoggerOptions ()
@@ -154,8 +183,8 @@ module Program =
         let logger = loggerProvider.CreateLogger "Gitea.App"
 
         use client = new HttpClient ()
-        client.BaseAddress <- giteaHost
-        client.DefaultRequestHeaders.Add ("Authorization", $"token {giteaApiToken}")
+        client.BaseAddress <- args.GiteaHost
+        client.DefaultRequestHeaders.Add ("Authorization", $"token {args.GiteaAdminApiToken}")
 
         let client = Gitea.Client client
 
@@ -172,7 +201,7 @@ module Program =
 
             match repoErrors with
             | Ok () -> ()
-            | Error errors -> do! Gitea.reconcileRepoErrors logger client githubApiToken errors
+            | Error errors -> do! Gitea.reconcileRepoErrors logger client args.GitHubApiToken errors
 
             match userErrors, repoErrors with
             | Ok (), Ok () -> return 0
diff --git a/nix/deps.nix b/nix/deps.nix
index b034947..d9f5262 100644
--- a/nix/deps.nix
+++ b/nix/deps.nix
@@ -1,6 +1,11 @@
 # This file was automatically generated by passthru.fetch-deps.
 # Please don't edit it manually, your changes might get overwritten!
 {fetchNuGet}: [
+  (fetchNuGet {
+    pname = "Argu";
+    version = "6.1.1";
+    sha256 = "1v996g0760qhiys2ahdpnvkldaxr2jn5f1falf789glnk4a6f3xl";
+  })
   (fetchNuGet {
     pname = "coverlet.collector";
     version = "3.1.2";
@@ -556,6 +561,11 @@
     version = "4.3.0";
     sha256 = "0wi10md9aq33jrkh2c24wr2n9hrpyamsdhsxdcnf43b7y86kkii8";
   })
+  (fetchNuGet {
+    pname = "System.Configuration.ConfigurationManager";
+    version = "4.4.0";
+    sha256 = "1hjgmz47v5229cbzd2pwz2h0dkq78lb2wp9grx8qr72pb5i0dk7v";
+  })
   (fetchNuGet {
     pname = "System.Diagnostics.Debug";
     version = "4.0.11";
@@ -816,6 +826,11 @@
     version = "4.3.0";
     sha256 = "0pyzncsv48zwly3lw4f2dayqswcfvdwq2nz0dgwmi7fj3pn64wby";
   })
+  (fetchNuGet {
+    pname = "System.Security.Cryptography.ProtectedData";
+    version = "4.4.0";
+    sha256 = "1q8ljvqhasyynp94a1d7jknk946m20lkwy2c3wa8zw2pc517fbj6";
+  })
   (fetchNuGet {
     pname = "System.Security.Cryptography.X509Certificates";
     version = "4.3.0";