diff --git a/go/cmd/entrypoint/host.go b/go/cmd/entrypoint/host.go
index fe52c6e..7ff8d4f 100644
--- a/go/cmd/entrypoint/host.go
+++ b/go/cmd/entrypoint/host.go
@@ -23,7 +23,7 @@ var subCmdHostCreate = subCmd{
 
 		hostNameF := flags.VarPF(
 			&hostName,
-			"hostname", "h",
+			"hostname", "n",
 			"Name of the host to generate bootstrap.json for",
 		)
 
@@ -111,7 +111,7 @@ var subCmdHostRemove = subCmd{
 
 		hostNameF := flags.VarPF(
 			&hostName,
-			"hostname", "h",
+			"hostname", "n",
 			"Name of the host to remove",
 		)
 
diff --git a/go/cmd/entrypoint/nebula.go b/go/cmd/entrypoint/nebula.go
index f7261b6..1ec8fe6 100644
--- a/go/cmd/entrypoint/nebula.go
+++ b/go/cmd/entrypoint/nebula.go
@@ -20,7 +20,7 @@ var subCmdNebulaCreateCert = subCmd{
 
 		hostNameF := flags.VarPF(
 			&hostName,
-			"hostname", "h",
+			"hostname", "n",
 			"Name of the host to generate a certificate for",
 		)
 
diff --git a/go/cmd/entrypoint/network.go b/go/cmd/entrypoint/network.go
index 4405f04..99a1af6 100644
--- a/go/cmd/entrypoint/network.go
+++ b/go/cmd/entrypoint/network.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"isle/daemon"
 	"isle/jsonutil"
-	"log"
 )
 
 var subCmdNetworkCreate = subCmd{
@@ -21,7 +20,7 @@ var subCmdNetworkCreate = subCmd{
 		)
 
 		name := flags.StringP(
-			"name", "n", "",
+			"name", "N", "",
 			"Human-readable name to identify the network as.",
 		)
 
@@ -39,7 +38,7 @@ var subCmdNetworkCreate = subCmd{
 
 		hostNameF := flags.VarPF(
 			&hostName,
-			"hostname", "h",
+			"hostname", "n",
 			"Name of this host, which will be the first host in the network",
 		)
 
@@ -61,9 +60,6 @@ var subCmdNetworkCreate = subCmd{
 			HostName: hostName.V,
 		}
 
-		log.Printf("req:%+v", req)
-		return nil
-
 		err := subCmdCtx.daemonRCPClient.Call(ctx, nil, "CreateNetwork", req)
 		if err != nil {
 			return fmt.Errorf("creating network: %w", err)
diff --git a/go/cmd/entrypoint/sub_cmd.go b/go/cmd/entrypoint/sub_cmd.go
index ce27c47..1c1b1e6 100644
--- a/go/cmd/entrypoint/sub_cmd.go
+++ b/go/cmd/entrypoint/sub_cmd.go
@@ -12,6 +12,22 @@ import (
 	"github.com/spf13/pflag"
 )
 
+type flagSet struct {
+	*pflag.FlagSet
+}
+
+func (fs flagSet) Parse(args []string) error {
+	fs.VisitAll(func(f *pflag.Flag) {
+		if f.Shorthand == "h" {
+			panic(fmt.Sprintf("flag %+v has reserved shorthand `-h`", f))
+		}
+		if f.Name == "help" {
+			panic(fmt.Sprintf("flag %+v has reserved name `--help`", f))
+		}
+	})
+	return fs.FlagSet.Parse(args)
+}
+
 // subCmdCtx contains all information available to a subCmd's do method.
 type subCmdCtx struct {
 	subCmd      subCmd   // the subCmd itself
@@ -42,7 +58,7 @@ func (ctx subCmdCtx) usagePrefix() string {
 	return fmt.Sprintf("\nUSAGE: %s %s", os.Args[0], subCmdNamesStr)
 }
 
-func (ctx subCmdCtx) flagSet(withPassthrough bool) *pflag.FlagSet {
+func (ctx subCmdCtx) flagSet(withPassthrough bool) flagSet {
 	flags := pflag.NewFlagSet(ctx.subCmd.name, pflag.ExitOnError)
 	flags.Usage = func() {
 
@@ -51,8 +67,6 @@ func (ctx subCmdCtx) flagSet(withPassthrough bool) *pflag.FlagSet {
 			passthroughStr = " [--] [args...]"
 		}
 
-		// TODO don't allow -h/--help flag to be set by sub-commands (or better,
-		// somehow check that a flag hasn't been set twice).
 		fmt.Fprintf(
 			os.Stderr, "%s[-h|--help] [%s flags...]%s\n\n",
 			ctx.usagePrefix(), ctx.subCmd.name, passthroughStr,
@@ -63,7 +77,7 @@ func (ctx subCmdCtx) flagSet(withPassthrough bool) *pflag.FlagSet {
 		os.Stderr.Sync()
 		os.Exit(2)
 	}
-	return flags
+	return flagSet{flags}
 }
 
 func (ctx subCmdCtx) doSubCmd(subCmds ...subCmd) error {