diff --git a/lib/config/admin.ts b/lib/config/admin.ts
index 33d0e99f846cea008284f8e2f66e0093461c1bfa..1bbb4b2ae8db757aa8a3e0b511dca5f9de10e677 100644
--- a/lib/config/admin.ts
+++ b/lib/config/admin.ts
@@ -2,17 +2,20 @@ import { RenovateConfig, RepoAdminConfig } from './common';
 
 let adminConfig: RepoAdminConfig = {};
 
-const derivedAdminOptions = ['localDir'];
+// TODO: once admin config work is complete, add a test to make sure this list includes all options with admin=true
+export const repoAdminOptions = [
+  'allowPostUpgradeCommandTemplating',
+  'allowedPostUpgradeCommands',
+  'dockerImagePrefix',
+  'dockerUser',
+  'trustLevel',
+];
 
-export function setAdminConfig(
-  config: RenovateConfig = {},
-  adminOptions = Object.keys(config)
-): void {
+export function setAdminConfig(config: RenovateConfig = {}): void {
   adminConfig = {};
-  const repoAdminOptions = adminOptions.concat(derivedAdminOptions);
   for (const option of repoAdminOptions) {
     adminConfig[option] = config[option];
-    // TODO: delete from config
+    delete config[option]; // eslint-disable-line no-param-reassign
   }
 }
 
diff --git a/lib/config/definitions.ts b/lib/config/definitions.ts
index cfe7c01d26be7fb0ed33e4e0819b042e7e910c40..f30e2df69258cb63be2050d40c47c516e0dacfc3 100644
--- a/lib/config/definitions.ts
+++ b/lib/config/definitions.ts
@@ -1920,10 +1920,6 @@ export function getOptions(): RenovateOptions[] {
   return options;
 }
 
-export function getAdminOptionNames(): string[] {
-  return options.filter((option) => option.admin).map((option) => option.name);
-}
-
 function loadManagerOptions(): void {
   for (const [name, config] of getManagers().entries()) {
     if (config.defaultConfig) {
diff --git a/lib/workers/global/index.ts b/lib/workers/global/index.ts
index e9075469fd1368e35979d666ae695edd16aa325a..4e072cc51b96059e30e3312baf84b89cb50e1e8f 100644
--- a/lib/workers/global/index.ts
+++ b/lib/workers/global/index.ts
@@ -4,8 +4,6 @@ import fs from 'fs-extra';
 import upath from 'upath';
 import * as configParser from '../../config';
 import { GlobalConfig } from '../../config';
-import { setAdminConfig } from '../../config/admin';
-import { getAdminOptionNames } from '../../config/definitions';
 import { getProblems, logger, setMeta } from '../../logger';
 import { setUtilConfig } from '../../util';
 import * as hostRules from '../../util/host-rules';
@@ -61,7 +59,6 @@ export async function start(): Promise<number> {
         break;
       }
       const repoConfig = await getRepositoryConfig(config, repository);
-      setAdminConfig(repoConfig, getAdminOptionNames());
       await setUtilConfig(repoConfig);
       if (repoConfig.hostRules) {
         hostRules.clear();
diff --git a/lib/workers/repository/index.ts b/lib/workers/repository/index.ts
index 370e1d3d14dfae15f8abc1e96356e4b0be2573e9..02c4ec312f3a3ab63ce715bb3183ac16810053ea 100644
--- a/lib/workers/repository/index.ts
+++ b/lib/workers/repository/index.ts
@@ -1,5 +1,6 @@
 import fs from 'fs-extra';
 import { RenovateConfig } from '../../config';
+import { setAdminConfig } from '../../config/admin';
 import { logger, setMeta } from '../../logger';
 import { deleteLocalFile, privateCacheDir } from '../../util/fs';
 import * as queue from '../../util/http/queue';
@@ -28,6 +29,7 @@ export async function renovateRepository(
 ): Promise<ProcessResult> {
   splitInit();
   let config = { ...repoConfig };
+  setAdminConfig(config);
   setMeta({ repository: config.repository });
   logger.info({ renovateVersion }, 'Repository started');
   logger.trace({ config });