diff --git a/Makefile b/Makefile
index 2321d02..861e7d0 100644
--- a/Makefile
+++ b/Makefile
@@ -29,6 +29,7 @@ install:
 		git add . \
 		&& git commit -m "distributed version of propellor" \
 		&& git bundle create $(DESTDIR)/usr/src/propellor/propellor.git master HEAD
+		&& git show-ref HEAD --hash > $(DESTDIR)/usr/src/propellor/head
 	rm -rf dist/gittmp
 
 clean:
diff --git a/debian/README.Debian b/debian/README.Debian
index 9fa53c7..fe18784 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -11,12 +11,3 @@ Note that upgrading the propellor package will not update your
 to the source, or may need to adapt your config.hs to work with the new
 version of propellor. Instead, if your ~/.propellor/ is from an older
 version of propellor, /usr/bin/propellor will warn that it's out of date.
-
-You can `git pull upstream` in your repository to update to the
-current upstream source, as distributed in the Debian package.
-
-In older versions of propellor, the upstream remote was pointed at
-the repository on github, so you may want to change it to point
-to the repository included in the Debian package:
-
-	git config remote.upstream.url /usr/src/propellor/propellor.git
diff --git a/debian/changelog b/debian/changelog
index 286c5a8..cd1ed61 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,8 +2,10 @@ propellor (0.8.3) UNRELEASED; urgency=medium
 
   * The Debian package now includes a single-revision git repository in
     /usr/src/propellor/, and ~/.propellor/ is set up to use this repository as
-    its "upstream" remote. This avoids relying on the security of the github
+    its origin remote. This avoids relying on the security of the github
     repository when using the Debian package.
+  * The /usr/bin/propellor wrapper will warn when ~/.propellor/ is out of date
+    and a newer version is available from origin.
   * Included the config.hs symlink to config-simple.hs in the cabal and Debian
     packages.
 
diff --git a/src/wrapper.hs b/src/wrapper.hs
index 3c1231e..7f68164 100644
--- a/src/wrapper.hs
+++ b/src/wrapper.hs
@@ -19,6 +19,7 @@ import Utility.Monad
 import Utility.Process
 import Utility.SafeCommand
 import Utility.Directory
+import Utility.Exception
 
 import Control.Monad
 import Control.Monad.IfElse
@@ -27,9 +28,10 @@ import System.FilePath
 import System.Environment (getArgs)
 import System.Exit
 import System.Posix.Directory
+import System.IO
 
-localrepo :: FilePath
-localrepo = "/usr/src/propellor/propellor.git"
+distrepo :: FilePath
+distrepo = "/usr/src/propellor/propellor.git"
 
 -- Using the github mirror of the main propellor repo because
 -- it is accessible over https for better security.
@@ -46,19 +48,34 @@ main = do
 
 wrapper :: [String] -> FilePath -> FilePath -> IO ()
 wrapper args propellordir propellorbin = do
-	unlessM (doesDirectoryExist propellordir) $
-		makeRepo
+	ifM (doesDirectoryExist propellordir)
+		( checkRepo 
+		, makeRepo
+		)
 	buildruncfg
   where
-	chain = do
-		(_, _, _, pid) <- createProcess (proc propellorbin args) 
-		exitWith =<< waitForProcess pid
 	makeRepo = do
 		putStrLn $ "Setting up your propellor repo in " ++ propellordir
 		putStrLn ""
-		localexists <- doesFileExist localrepo <||> doesDirectoryExist localrepo
-		let repo = if localexists then localrepo else netrepo
+		distexists <- doesFileExist distrepo <||> doesDirectoryExist distrepo
+		let repo = if distexists then distrepo else netrepo
 		void $ boolSystem "git" [Param "clone", File repo, File propellordir]
+
+	disthead = propellordir </> "head"
+
+	checkRepo = whenM (doesFileExist disthead) $ do
+		head <- readFile disthead
+		changeWorkingDirectory propellordir
+		headknown <- catchMaybeIO $ 
+			withQuietOutput createProcessSuccess $
+				proc "git" ["log", head]
+		when (headknown == Nothing)
+			warnoutofdate
+	warnoutofdate = do
+		let n = hPutStrLn stderr
+		n ("** Your " ++ propellordir ++ " is out of date..")
+		n ("   A newer upstream version is available in " ++ distrepo)
+		n ("   To merge it, run eg: git pull origin master")
 	buildruncfg = do
 		changeWorkingDirectory propellordir
 		ifM (boolSystem "make" [Param "build"])
@@ -68,3 +85,7 @@ wrapper args propellordir propellorbin = do
 				chain
 			, error "Propellor build failed."
 			)
+	chain = do
+		(_, _, _, pid) <- createProcess (proc propellorbin args) 
+		exitWith =<< waitForProcess pid
+