diff --git a/letsencrypt_auto/letsencrypt-auto.template b/letsencrypt_auto/letsencrypt-auto.template
index 6f11efce3..3c64356c0 100755
--- a/letsencrypt_auto/letsencrypt-auto.template
+++ b/letsencrypt_auto/letsencrypt-auto.template
@@ -1,6 +1,9 @@
 #!/bin/sh
 #
 # Download and run the latest release version of the Let's Encrypt client.
+#
+# WARNING: "letsencrypt-auto" IS A GENERATED FILE. EDIT
+# letsencrypt-auto.template INSTEAD.
 
 set -e  # Work even if somebody does "sh thisscript.sh".
 
@@ -147,10 +150,55 @@ else
   SUDO=
 fi
 
-if [ "$1" = "--os-packages-only" ]; then
+if [ ! -f $VENV_BIN/letsencrypt ]; then
+  # If it looks like we've never bootstrapped before, bootstrap:
   Bootstrap
-elif [ "$1" != "--_skip-to-install" ]; then
-  echo "Upgrading letsencrypt-auto..."
+fi
+if [ "$1" = "--os-packages-only" ]; then
+  echo "OS packages installed."
+elif [ "$1" = "--no-self-upgrade" ]; then
+  # Phase 2: Create venv, install LE, and run.
+
+  shift 1  # the --no-self-upgrade arg
+  echo "Creating virtual environment..."
+  # TODO: Embed LE version here, and compare it against letsencrypt --version.
+  # If it matches, there's no need to recreate the venv.
+  rm -rf "$VENV_PATH"
+  DeterminePythonVersion
+  if [ "$VERBOSE" = 1 ]; then
+    virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH
+  else
+    virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH > /dev/null
+  fi
+
+  # Install Python dependencies with peep, then run letsencrypt.
+  echo "Installing Python package dependencies..."
+  TEMP_DIR=`mktemp -d 2>/dev/null || mktemp -d -t 'le'`  # Linux || OS X
+  # ---------------------------------------------------------------------------
+  cat << "UNLIKELY_EOF" > $TEMP_DIR/letsencrypt-auto-requirements.txt
+{{ letsencrypt-auto-requirements.txt }}
+UNLIKELY_EOF
+  # ---------------------------------------------------------------------------
+  cat << "UNLIKELY_EOF" > $TEMP_DIR/peep.py
+{{ peep.py }}
+UNLIKELY_EOF
+  # ---------------------------------------------------------------------------
+  set +e
+  PEEP_OUT=`$VENV_BIN/python $TEMP_DIR/peep.py install -r $TEMP_DIR/letsencrypt-auto-requirements.txt`
+  PEEP_STATUS=$?
+  set -e
+  rm -rf $TEMP_DIR
+  if [ "$PEEP_STATUS" = 0 ]; then
+    echo "Running letsencrypt..."
+    echo "  " $SUDO $VENV_BIN/letsencrypt "$@"
+    $SUDO $VENV_BIN/letsencrypt "$@"
+  else
+    # Report error:
+    echo $PEEP_OUT
+    exit 1
+  fi
+else
+  # Phase 1: Upgrade letsencrypt-auto if neceesary, then self-invoke.
 
   if [ ! -f $VENV_BIN/letsencrypt ]; then
     OLD_VERSION="0.0.0"  # ($VENV_BIN/letsencrypt --version)
@@ -160,15 +208,8 @@ elif [ "$1" != "--_skip-to-install" ]; then
 
   # TODO: Don't bother upgrading if we're already up to date.
   if [ "$OLD_VERSION" != "1.2.3" ]; then
-    Bootstrap
-    echo "Creating virtual environment..."
-    rm -rf "$VENV_PATH"
+    echo "Upgrading letsencrypt-auto..."
     DeterminePythonVersion
-    if [ "$VERBOSE" = 1 ]; then
-      virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH
-    else
-      virtualenv --no-site-packages --python $LE_PYTHON $VENV_PATH > /dev/null
-    fi
 
     # Now we drop into Python so we don't have to install even more
     # dependencies (curl, etc.), for better flow control, and for the option of
@@ -193,38 +234,12 @@ UNLIKELY_EOF`
       echo "  " $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
       $SUDO cp "$TEMP_DIR/letsencrypt-auto" "$0"
       # TODO: Clean up temp dir safely, even if it has quotes in its path.
-      "$0" --_skip-to-install "$TEMP_DIR" "$@"
+      rm -rf $TEMP_DIR
+      "$0" --no-self-upgrade "$@"
     else
       # Report error:
       echo $TEMP_DIR
       exit 1
     fi
   fi  # should upgrade
-else  # --_skip-to-install was passed.
-  # Install Python dependencies with peep, then run letsencrypt.
-  echo "Installing Python package dependencies..."
-  TEMP_DIR="$2"
-  shift 2
-  # ---------------------------------------------------------------------------
-  cat << "UNLIKELY_EOF" > $TEMP_DIR/letsencrypt-auto-requirements.txt
-{{ letsencrypt-auto-requirements.txt }}
-UNLIKELY_EOF
-  # ---------------------------------------------------------------------------
-  cat << "UNLIKELY_EOF" > $TEMP_DIR/peep.py
-{{ peep.py }}
-UNLIKELY_EOF
-  # ---------------------------------------------------------------------------
-  set +e
-  PEEP_OUT=`$LE_PYTHON $TEMP_DIR/peep.py install -r $TEMP_DIR/letsencrypt-auto-requirements.txt`
-  PEEP_STATUS=$?
-  set -e
-  if [ "$PEEP_STATUS" = 0 ]; then
-    echo "Running letsencrypt..."
-    echo "  " $SUDO $VENV_BIN/letsencrypt "$@"
-    $SUDO $VENV_BIN/letsencrypt "$@"
-  else
-    # Report error:
-    echo $PEEP_OUT
-    exit 1
-  fi
 fi