diff --git a/scripts/sync-admin.sh b/scripts/sync-admin.sh
index 5986ea4..71e67ce 100755
--- a/scripts/sync-admin.sh
+++ b/scripts/sync-admin.sh
@@ -4,6 +4,10 @@
 # workflows and label files they replace. Only touches working trees; review and commit
 # in each repo afterwards.
 #
+# A repo can opt out of templates with .github/admin-skip: one template file name per line
+# (# comments allowed), e.g. admin-dependency-review.yml in a private repo without GitHub
+# Advanced Security. Skipped templates are removed from the repo if present.
+#
 #   scripts/sync-admin.sh [--check] [root]
 #
 # --check reports repos that are out of date and exits non-zero, changing nothing.
@@ -33,8 +37,16 @@ while IFS= read -r gitdir; do
   [[ $url =~ github\.com[:/]rhizomatics/ ]] || continue
 
   changes=()
+  skip=()
+  [[ -f $repo/.github/admin-skip ]] && mapfile -t skip < <(sed -e 's/#.*//' -e 's/[[:space:]]//g' -e '/^$/d' "$repo/.github/admin-skip")
   for tpl in "$here"/templates/workflows/*.yml; do
     dest=$repo/.github/workflows/$(basename "$tpl")
+    if [[ " ${skip[*]} " == *" $(basename "$tpl") "* ]]; then
+      [[ -e $dest ]] || continue
+      changes+=("remove $(basename "$tpl") (admin-skip)")
+      $check || rm "$dest"
+      continue
+    fi
     cmp -s "$tpl" "$dest" && continue
     changes+=("update $(basename "$tpl")")
     $check || { mkdir -p "$(dirname "$dest")"; cp "$tpl" "$dest"; }
diff --git a/templates/README.md b/templates/README.md
index 2985038..4514802 100644
--- a/templates/README.md
+++ b/templates/README.md
@@ -24,6 +24,11 @@ scripts/sync-admin.sh           # copy callers in, remove the per-repo workflows
 
 Then commit in each repo.
 
+A repo that shouldn't get a template lists its file name in `.github/admin-skip`, one per line (`#`
+comments allowed); `sync-admin.sh` then leaves it out and removes it if present. Example: hq-private
+skips `admin-dependency-review.yml` (a private repo without GitHub Advanced Security can't run it)
+and `admin-dependabot-automerge.yml` (no Dependabot there).
+
 ## Shared mise tasks
 
 `sync-admin.sh` copies [mise file tasks](https://mise.jdx.dev/tasks/file-tasks.html) into each