diff --git a/zsh/zshrc b/zsh/zshrc
index bb39a02..8d625ca 100644
--- a/zsh/zshrc
+++ b/zsh/zshrc
@@ -69,9 +69,10 @@ _DOTFILES_CONF="$HOME/.config/dotfiles"
 [ -f "$_DOTFILES_CONF/secrets.env" ] && source "$_DOTFILES_CONF/secrets.env"
 
 # opr NAME           read one field straight from the vault
-# opc NAME [VALUE]   create or update a field (prompts, hidden, when VALUE is
-#                    omitted, which keeps the secret out of shell history),
-#                    then refresh and reload this shell
+# opc NAME=VALUE     create or update a field, then refresh and reload this
+# opc NAME           shell; with no VALUE (NAME or NAME=) it prompts, hidden,
+#                    which keeps the secret out of shell history.
+#                    `opc NAME VALUE` also still works.
 # opd NAME           delete a field, refresh, and unset it in this shell
 # opl [VAULT [ITEM]] show every field and its current value (default: your
 #                    vault and item from op.env)
@@ -94,11 +95,16 @@ opr() {
 opc() {
   emulate -L zsh
   local name=$1 value
-  _dotfiles_env_name "$name" opc || return
-  if (( $# >= 2 )); then
+  if [[ $1 == *=* ]]; then
+    # NAME=VALUE: split on the first '=' so values may contain '='
+    name=${1%%=*} value=${1#*=}
+  elif (( $# >= 2 )); then
     value=$2
-  else
+  fi
+  _dotfiles_env_name "$name" opc || return
+  if [[ -z $value ]]; then
     read -rs "value?$name: " && print
+    [[ -n $value ]] || { print -u2 "opc: empty value for $name; nothing changed"; return 1; }
   fi
   # [concealed] makes it a password field; an existing field of that name is updated.
   _dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[concealed]=$2" >/dev/null' \