diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77a7a57..545aab0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -106,6 +106,8 @@ All notable changes to Housecarl are documented here. The format follows
 
 ### Changed
 
+- `hc user delete` asks first, as every other delete does, and takes
+  `-y`/`--yes` not to; it deleted the user and their tokens at once.
 - The ruleset's diff (Changes, `hc changeset diff`, `--dry-run`) names
   the chain each part is in on its `@@` line (`@@ -40,6 +40,8 @@ chain
   forward`), as `git diff` names the function, so a rule added deep in a
diff --git a/cmd/hc/admin.go b/cmd/hc/admin.go
index 3ab9f61..ded093a 100644
--- a/cmd/hc/admin.go
+++ b/cmd/hc/admin.go
@@ -349,9 +349,13 @@ operator, log) or grants such as --grant config:read --grant sets:write:guests.
 	f.BoolVar(&enable, "enable", false, "enable the user again")
 	f.StringVar(&comment, "comment", "", "a comment")
 	cmd.AddCommand(update)
-	cmd.AddCommand(&cobra.Command{
+	var yes bool
+	del := &cobra.Command{
 		Use: "delete USER", Short: "Delete a user and their tokens", Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			if !confirm(fmt.Sprintf("Delete user %s and their tokens?", args[0]), yes) {
+				return fmt.Errorf("not deleted")
+			}
 			id, err := userID(args[0])
 			if err != nil {
 				return err
@@ -365,7 +369,9 @@ operator, log) or grants such as --grant config:read --grant sets:write:guests.
 			}
 			return nil
 		},
-	})
+	}
+	del.Flags().BoolVarP(&yes, "yes", "y", false, "don't ask")
+	cmd.AddCommand(del)
 	return cmd
 }