diff --git a/Dockerfile b/Dockerfile
index 95fd64d..385a27b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -51,7 +51,7 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
-# Run tests and build. Both first run `make assets`, which extracts Alpine.js
+# Run tests and build. Both first run script/assets, which extracts Alpine.js
 # from its tarball in 3p/.
 RUN make test
 
diff --git a/Makefile b/Makefile
index 06846e2..b5438f8 100644
--- a/Makefile
+++ b/Makefile
@@ -27,13 +27,10 @@ bootstrap:
 setup:
 	@script/setup
 
-# Alpine.js is committed as its npm package tarball in 3p/. This extracts
-# the browser build from it to where go:embed reads it; the extracted file
-# is not committed.
 assets:
-	tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js >static/js/alpine.min.js
+	@script/assets
 
-test: assets
+test:
 	@script/test
 
 lint:
@@ -45,7 +42,7 @@ fmt:
 fmt-check:
 	@script/fmt-check
 
-check: assets
+check:
 	@script/check
 
 build: assets
diff --git a/README.md b/README.md
index 744d21b..c11b46c 100644
--- a/README.md
+++ b/README.md
@@ -1247,16 +1247,16 @@ What that means for an operator:
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
-development workflow. Nine of the Makefile's seventeen targets are thin
-shims that call them; `assets`, `build`, `run`, `dev`, `deps`, `clean`,
-`css` and `version` are inline commands with no script behind them,
-though `build` and `version` both take their value from
-`script/version`.
+development workflow. Ten of the Makefile's seventeen targets are thin
+shims that call them; `build`, `run`, `dev`, `deps`, `clean`, `css` and
+`version` are inline commands with no script behind them, though `build`
+and `version` both take their value from `script/version`.
 
-`make test`, `make check`, `make build` and `make dev` each run
-`make assets` first, which writes the ignored `static/js/alpine.min.js`
-(see [Third-party browser assets](#third-party-browser-assets)), so
-`make check` works on a fresh clone without a separate setup step.
+`script/test`, `make build` and `make dev` each run `script/assets`
+first, which writes the ignored `static/js/alpine.min.js` (see
+[Third-party browser assets](#third-party-browser-assets)), so
+`make test`, `make check` and the pre-commit hook work on a fresh clone
+without a separate step.
 
 We provide:
 
@@ -1264,6 +1264,8 @@ We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
+- `script/assets` — extract Alpine.js from its tarball in `3p/` (see
+  [Third-party browser assets](#third-party-browser-assets))
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint in Docker (see Linting below)
 - `script/fmt` — format all code (writes)
@@ -1292,19 +1294,18 @@ publishes it. It is a dependency, not this repo's build output, so
 The directory is `3p/` rather than `vendor/` because Go treats a root
 `vendor/` directory as its module vendor directory.
 
-`make assets` extracts the browser build, `package/dist/cdn.min.js`, from the
-tarball to `static/js/alpine.min.js`, where `go:embed` picks it up.
-`make test`, `make check`, `make build` and `make dev` run it first, and the
-Dockerfile builds through them, so no build downloads anything. The extracted
-file is not committed, and `.dockerignore` keeps any host copy out of the
-build context.
+`script/assets` (`make assets`) extracts the browser build,
+`package/dist/cdn.min.js`, from the tarball to `static/js/alpine.min.js`,
+where `go:embed` picks it up. `script/test`, `make build` and `make dev` run
+it first, and the Dockerfile builds through `make test` and `make build`, so
+nothing downloads Alpine.js. The extracted file is not committed, and
+`.dockerignore` keeps any host copy out of the build context.
 
 To move to a new version: download
 `https://registry.npmjs.org/alpinejs/-/alpinejs-<version>.tgz`, check it
 against the `dist.integrity` hash listed at
 `https://registry.npmjs.org/alpinejs/<version>`, replace the tarball in `3p/`
-with it, update its file name in the Makefile's `assets` target, and run
-`make check`.
+with it, update its file name in `script/assets`, and run `make check`.
 
 ## Rationale
 
@@ -2883,7 +2884,7 @@ webhooker/
 ├── script/                    # Scripts to Rule Them All entrypoints
 ├── Dockerfile                 # Three stages: lint, test+build, Alpine runtime
 ├── Dockerfile.lint            # Lint-only image built by script/lint
-├── Makefile                   # 9 of 17 targets shim script/; 8 are inline
+├── Makefile                   # 10 of 17 targets shim script/; 7 are inline
 ├── go.mod / go.sum
 └── .golangci.yml              # Linter configuration
 ```
diff --git a/script/assets b/script/assets
new file mode 100755
index 0000000..69db60d
--- /dev/null
+++ b/script/assets
@@ -0,0 +1,16 @@
+#!/bin/sh
+# script/assets: extract Alpine.js from its npm package tarball, committed
+# in 3p/, to static/js/alpine.min.js, where go:embed reads it. The
+# extracted file is not committed. script/test, make build and make dev run
+# this first.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js \
+        >static/js/alpine.min.js
+}
+
+main "$@"
diff --git a/script/test b/script/test
index bfa9129..44f0308 100755
--- a/script/test
+++ b/script/test
@@ -28,6 +28,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    "$ROOT/script/assets"
     go test -v -race -timeout 90s ./...
 }