diff --git a/.ember-cli b/.ember-cli
index ee64cfed2a8..fdc746c3cc4 100644
--- a/.ember-cli
+++ b/.ember-cli
@@ -5,5 +5,6 @@
 
     Setting `disableAnalytics` to true will prevent any data from being sent.
   */
-  "disableAnalytics": false
+  "disableAnalytics": false,
+  "port": 4201
 }
diff --git a/.env.sample b/.env.sample
index 58f047ed21e..4884de8b392 100644
--- a/.env.sample
+++ b/.env.sample
@@ -72,3 +72,7 @@ export GH_CLIENT_SECRET=
 # Credentials for connecting to the Sentry error reporting service.
 # export SENTRY_DSN_API=
 export SENTRY_ENV_API=local
+
+# GitHub users that are admins on this instance, separated by commas. Whitespace
+# will be ignored.
+export GH_ADMIN_USERS=
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 00000000000..63fe8535083
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,8 @@
+http://localhost:4200, http://127.0.0.1:4200 {
+	@backend {
+		path /api/* /admin/* /git/*
+	}
+
+	reverse_proxy @backend 127.0.0.1:8888
+	reverse_proxy 127.0.0.1:4201
+}
diff --git a/Cargo.lock b/Cargo.lock
index 3b0584fb21e..3c634b5a6cf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -335,6 +335,18 @@ dependencies = [
  "syn 2.0.15",
 ]
 
+[[package]]
+name = "axum-template"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f926c4ca412af0a88bd119a6d214b026a0c98d8c763eaead70032628d3d0a549"
+dependencies = [
+ "axum",
+ "handlebars",
+ "serde",
+ "thiserror",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.67"
@@ -447,6 +459,7 @@ dependencies = [
  "aws-sigv4",
  "axum",
  "axum-extra",
+ "axum-template",
  "base64 0.13.1",
  "cargo-registry-index",
  "cargo-registry-markdown",
@@ -465,6 +478,7 @@ dependencies = [
  "flate2",
  "futures-channel",
  "futures-util",
+ "handlebars",
  "hex",
  "http",
  "http-body",
@@ -474,6 +488,7 @@ dependencies = [
  "indicatif",
  "insta",
  "ipnetwork",
+ "lazy_static",
  "lettre",
  "minijinja",
  "moka",
@@ -485,6 +500,7 @@ dependencies = [
  "reqwest",
  "retry",
  "ring",
+ "rust-embed",
  "scheduled-thread-pool",
  "semver",
  "sentry",
@@ -1285,6 +1301,22 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "handlebars"
+version = "4.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "035ef95d03713f2c347a72547b7cd38cbc9af7cd51e6099fb62d586d4a6dee3a"
+dependencies = [
+ "log",
+ "pest",
+ "pest_derive",
+ "rust-embed",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "walkdir",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -2550,6 +2582,40 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "rust-embed"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b68543d5527e158213414a92832d2aab11a84d2571a5eb021ebe22c43aab066"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "6.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4e0f0ced47ded9a68374ac145edd65a6c1fa13a96447b873660b2a568a0fd7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn 1.0.109",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "7.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512b0ab6853f7e14e3c8754acb43d6f748bb9ced66aa5915a6553ac8213f7731"
+dependencies = [
+ "sha2",
+ "walkdir",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
diff --git a/Cargo.toml b/Cargo.toml
index aa0c3082766..734c32445c2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -26,6 +26,7 @@ anyhow = "=1.0.70"
 aws-sigv4 = "=0.55.1"
 axum = { version = "=0.6.16", features = ["headers", "macros", "matched-path"] }
 axum-extra = { version = "=0.7.4", features = ["cookie-signed"] }
+axum-template = { version = "0.15.1", features = ["handlebars"] }
 base64 = "=0.13.1"
 cargo-registry-index = { path = "cargo-registry-index" }
 cargo-registry-markdown = { path = "cargo-registry-markdown" }
@@ -43,6 +44,7 @@ dotenv = "=0.15.0"
 flate2 = "=1.0.25"
 futures-channel = { version = "=0.3.28", default-features = false }
 futures-util = "=0.3.28"
+handlebars = { version = "4.3.6", features = ["dir_source", "rust-embed"] }
 hex = "=0.4.3"
 http = "=0.2.9"
 http-body = "=0.4.5"
@@ -50,7 +52,7 @@ hyper = { version = "=0.14.26", features = ["backports", "client", "deprecated",
 indexmap = { version = "=1.9.3", features = ["serde-1"] }
 indicatif = "=0.17.3"
 ipnetwork = "=0.20.0"
-tikv-jemallocator = { version = "=0.5.0", features = ['unprefixed_malloc_on_supported_platforms', 'profiling'] }
+lazy_static = "1.4.0"
 lettre = { version = "=0.10.4", default-features = false, features = ["file-transport", "smtp-transport", "native-tls", "hostname", "builder"] }
 minijinja = "=0.31.1"
 moka = { version = "=0.10.2", features = ["future"]  }
@@ -62,6 +64,7 @@ rand = "=0.8.5"
 reqwest = { version = "=0.11.16", features = ["blocking", "gzip", "json"] }
 retry = "=2.0.0"
 ring = "=0.16.20"
+rust-embed = { version = "6.6.1" }
 scheduled-thread-pool = "=0.2.7"
 semver = { version = "=1.0.17", features = ["serde"] }
 sentry = { version = "=0.30.0", features = ["tracing", "tower", "tower-http"] }
@@ -73,6 +76,7 @@ tar = "=0.4.38"
 tempfile = "=3.5.0"
 thiserror = "=1.0.40"
 threadpool = "=1.8.1"
+tikv-jemallocator = { version = "=0.5.0", features = ['unprefixed_malloc_on_supported_platforms', 'profiling'] }
 tokio = { version = "=1.27.0", features = ["net", "signal", "io-std", "io-util", "rt-multi-thread", "macros"]}
 toml = "=0.7.3"
 tower = "=0.4.13"
diff --git a/admin/templates/components/datetime.hbs b/admin/templates/components/datetime.hbs
new file mode 100644
index 00000000000..eeaee423825
--- /dev/null
+++ b/admin/templates/components/datetime.hbs
@@ -0,0 +1 @@
+<span title='{{this.absolute}}'>{{this.human}}</span>
\ No newline at end of file
diff --git a/admin/templates/components/page.hbs b/admin/templates/components/page.hbs
new file mode 100644
index 00000000000..00f1abac0b1
--- /dev/null
+++ b/admin/templates/components/page.hbs
@@ -0,0 +1,27 @@
+{{#if this.paginated}}
+<nav>
+  <ul class="pagination">
+    {{#if this.previous}}
+      <li class="page-item">
+        <a class="page-link" href="{{ this.previous }}">
+          <span>&laquo;</span>
+        </a>
+      </li>
+    {{/if}}
+    {{#each this.pages}}
+      <li class="page-item">
+        <a class="page-link {{#if this.active}}active{{/if}}" href="{{ this.url }}">
+          <span>{{ this.number }}</span>
+        </a>
+      </li>
+    {{/each}}
+    {{#if this.next}}
+      <li class="page-item">
+        <a class="page-link" href="{{ this.next }}">
+          <span>&raquo;</span>
+        </a>
+      </li>
+    {{/if}}
+  </ul>
+</nav>
+{{/if}}
\ No newline at end of file
diff --git a/admin/templates/components/user.hbs b/admin/templates/components/user.hbs
new file mode 100644
index 00000000000..4d5c3d6e169
--- /dev/null
+++ b/admin/templates/components/user.hbs
@@ -0,0 +1,13 @@
+<a href='/users/{{this.username}}'>
+  {{#if this.avatar}}
+    <img
+      src='{{this.avatar}}'
+      alt='{{this.username}}'
+      aria-hidden='true'
+      width='32'
+      height='32'
+      class='d-inline-block me-1'
+    />
+  {{~/if~}}
+  {{~this.username}}
+</a>
\ No newline at end of file
diff --git a/admin/templates/crates.hbs b/admin/templates/crates.hbs
new file mode 100644
index 00000000000..2d654dc9178
--- /dev/null
+++ b/admin/templates/crates.hbs
@@ -0,0 +1,97 @@
+{{#*inline "body"}}
+  <div class="d-flex align-items-end mt-3 mb-3">
+    <h1 class="me-auto">{{> title}}</h1>
+    <form class="d-flex align-items-center" method="GET">
+      <input class="form-control" name="q" type="search" placeholder="crate name" spellcheck="false" value="{{this.q}}">
+    </form>
+  </div>
+
+  <table class="table align-middle">
+    <thead>
+      <tr>
+        <th>Crate</th>
+        <th>Version</th>
+        <th>Published</th>
+        <th/>
+      <tr>
+    </thead>
+    <tbody>
+      {{#each this.versions}}
+        <tr>
+          <td>
+            <div>
+              <a href="/crates/{{this.name}}">
+                {{#if this.yanked}}
+                  <s>{{this.name}}</s>
+                {{~else}}
+                  {{this.name}}
+                {{/if~}}
+              </a>
+              {{#if this.yanked}}<i title="Yanked" class="bi bi-trash-fill"></i>{{/if}}
+            </div>
+            <div style="font-size: 80%"><a href="https://index.crates.io/{{crate-index-path this.name}}">View in sparse index</a></div>
+          </td>
+          <td>{{this.num}}</td>
+          <td>
+            <em>{{> components/datetime this.created_at}}</em>
+            by
+            {{> components/user this.publisher }}
+          </td>
+          <td class="text-end">
+            {{#if this.yanked}}
+              <button type="button" class="btn btn-outline-primary unyank" data-unyank-name="{{this.name}}" data-unyank-version="{{this.num}}">Unyank</button>
+            {{else}}
+              <button type="button" class="btn btn-danger yank" data-yank-name="{{this.name}}" data-yank-version="{{this.num}}">Yank</button>
+            {{/if}}
+          </td>
+        </tr>
+      {{/each}}
+    </tbody>
+  </table>
+
+  {{> components/page this.page}}
+
+  <script>
+    window.addEventListener("DOMContentLoaded", () => {
+      document.querySelectorAll("[data-yank-name]").forEach(btn => {
+        const name = btn.getAttribute("data-yank-name");
+        const version = btn.getAttribute("data-yank-version");
+
+        btn.addEventListener("click", async event => {
+          event.preventDefault();
+          if (confirm(`Are you sure you want to yank ${name} ${version}?`)) {
+            btn.disabled = true;
+            btn.innerHTML = "<div class='spinner-border' role='status'></div>";
+
+            try {
+              const response = await fetch(`/api/v1/crates/${name}/${version}/yank`, {
+                method: "DELETE",
+              });
+
+              if (response.status >= 400){
+                throw `Unexpected status code: ${response.status}`;
+              }
+
+              // Errors can also be returned as a top level errors field.
+              const data = await response.json();
+              if ("errors" in data) {
+                throw data.errors.map(error => error.detail).join("; ");
+              }
+
+              window.location.reload();
+            } catch (e) {
+              btn.innerHTML = `<span data-bs-toggle="tooltip"><i class="bi bi-exclamation-octagon-fill"></i> Error</span>`;
+              const error = document.createElement("div");
+              error.innerText = e.toString();
+              btn.parentElement.appendChild(error);
+            }
+          }
+        });
+      });
+    });
+  </script>
+{{/inline}}
+
+{{#*inline "title"}}Crates{{/inline}}
+
+{{> page}}
\ No newline at end of file
diff --git a/admin/templates/page.hbs b/admin/templates/page.hbs
new file mode 100644
index 00000000000..61ff0f0242f
--- /dev/null
+++ b/admin/templates/page.hbs
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>{{> title}} :: crates.io</title>
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-KK94CHFLLe+nY2dmCWGMq91rCGa5gtU4mk92HdvYe+M/SXH301p5ILy+dN9+nJOZ" crossorigin="anonymous">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.4/font/bootstrap-icons.css" integrity="sha384-LrVLJJYk9OiJmjNDakUBU7kS9qCT8wk1j2OU7ncpsfB3QS37UPdkCuq3ZD1MugNY" crossorigin="anonymous">
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ENjdO4Dr2bkBIFxQpeoTz1HIcje39Wm4jDKdf19U8gI4ddQ3GYNS7NTKfAdVQSZe" crossorigin="anonymous"></script>
+  </head>
+  <body>
+    <nav class="navbar sticky-top navbar-expand-lg bg-dark" data-bs-theme="dark">
+      <div class="container-fluid">
+        <a class="navbar-brand" href="/admin/">crates.io admin</a>
+        <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
+          <span class="navbar-toggler-icon"></span>
+        </button>
+        <div class="collapse navbar-collapse" id="navbarSupportedContent">
+          <ul class="navbar-nav me-auto mb-2 mb-lg-0">
+            <li class="nav-item">
+              <a class="nav-link" href="/admin/crates/">Recent uploads</a>
+            </li>
+          </ul>
+        </div>
+      </div>
+    </nav>
+    <div class="container">
+      {{> body}}
+    </div>
+  </body>
+</html>
\ No newline at end of file
diff --git a/app/components/header.hbs b/app/components/header.hbs
index 1426d929173..2056704362d 100644
--- a/app/components/header.hbs
+++ b/app/components/header.hbs
@@ -29,6 +29,9 @@
             <menu.Item><LinkTo @route="dashboard">Dashboard</LinkTo></menu.Item>
             <menu.Item><LinkTo @route="settings">Account Settings</LinkTo></menu.Item>
             <menu.Item><LinkTo @route="me.pending-invites">Owner Invites</LinkTo></menu.Item>
+            {{#if this.session.currentUser.admin }}
+              <menu.Item><a href="/admin/">Site Admin</a></menu.Item>
+            {{/if}}
             <menu.Item local-class="menu-item-with-separator">
               <button
                 type="button"
diff --git a/app/models/user.js b/app/models/user.js
index cc5e3f62589..a80d1c2df1b 100644
--- a/app/models/user.js
+++ b/app/models/user.js
@@ -14,6 +14,7 @@ export default class User extends Model {
   @attr avatar;
   @attr url;
   @attr kind;
+  @attr admin;
 
   async stats() {
     return await apiAction(this, { method: 'GET', path: 'stats' });
diff --git a/config/nginx.conf.erb b/config/nginx.conf.erb
index 5afcefc59a0..356dc8687ac 100644
--- a/config/nginx.conf.erb
+++ b/config/nginx.conf.erb
@@ -237,6 +237,10 @@ http {
 		<% if ENV['USE_FASTBOOT'] == "staging-experimental" %>
 			# Experimentally send all non-backend requests to FastBoot
 
+            location /admin/ {
+                proxy_pass http://app_server;
+            }
+
 			location /api/ {
 				proxy_pass http://app_server;
 			}
diff --git a/src/app.rs b/src/app.rs
index ae069722f5c..1e7a4ad42fc 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -1,6 +1,7 @@
 //! Application-wide components in a struct accessible from each request
 
 use crate::db::{ConnectionConfig, DieselPool, DieselPooledConn, PoolError};
+use crate::views::admin::templating;
 use crate::{config, Env};
 use std::ops::Deref;
 use std::sync::atomic::AtomicUsize;
@@ -11,7 +12,9 @@ use crate::email::Emails;
 use crate::github::{GitHubClient, RealGitHubClient};
 use crate::metrics::{InstanceMetrics, ServiceMetrics};
 use axum::extract::{FromRef, FromRequestParts, State};
+use axum_template::engine::Engine;
 use diesel::r2d2;
+use handlebars::Handlebars;
 use moka::future::{Cache, CacheBuilder};
 use oauth2::basic::BasicClient;
 use reqwest::blocking::Client;
@@ -65,6 +68,9 @@ pub struct App {
 
     /// In-flight request counters for the `balance_capacity` middleware.
     pub balance_capacity: BalanceCapacityState,
+
+    /// Admin templating engine.
+    pub admin_engine: Engine<Handlebars<'static>>,
 }
 
 impl App {
@@ -175,6 +181,9 @@ impl App {
             _ => None,
         };
 
+        let admin_engine =
+            templating::engine().expect("could not initialise admin templating engine");
+
         App {
             primary_database,
             read_only_replica_database: replica_database,
@@ -189,6 +198,7 @@ impl App {
             fastboot_client,
             balance_capacity: Default::default(),
             config,
+            admin_engine,
         }
     }
 
diff --git a/src/controllers.rs b/src/controllers.rs
index c4d29d61109..7df20e7e675 100644
--- a/src/controllers.rs
+++ b/src/controllers.rs
@@ -64,6 +64,7 @@ mod prelude {
 pub mod helpers;
 pub mod util;
 
+pub mod admin;
 pub mod category;
 mod conduit_axum;
 pub mod crate_owner_invitation;
diff --git a/src/controllers/admin.rs b/src/controllers/admin.rs
new file mode 100644
index 00000000000..4d84f0d19e1
--- /dev/null
+++ b/src/controllers/admin.rs
@@ -0,0 +1,89 @@
+use super::prelude::*;
+use axum::extract::Query;
+use diesel::sql_types::Text;
+use diesel_full_text_search::{TsQuery, TsQueryExtensions};
+
+use crate::{
+    controllers::helpers::pagination::{Page, Paginate, Paginated, PaginationOptions},
+    extractors::admin::AdminUser,
+    models::{Crate, User, Version},
+    views::admin::crates::render,
+};
+
+/// Handles the `GET /admin/` route.
+pub async fn index(_user: AdminUser) -> impl IntoResponse {
+    redirect("/admin/crates/".to_string())
+}
+
+#[derive(Deserialize)]
+pub struct CrateQuery {
+    q: Option<String>,
+    page: Option<u32>,
+}
+
+impl CrateQuery {
+    fn page(&self) -> u32 {
+        self.page.unwrap_or(1)
+    }
+
+    fn query_string(&self) -> Option<&str> {
+        match &self.q {
+            Some(q) if !q.is_empty() => Some(q.as_str()),
+            _ => None,
+        }
+    }
+}
+
+/// Handles the `GET /admin/crates/` route.
+pub async fn crates(
+    app: AppState,
+    q: Query<CrateQuery>,
+    _user: AdminUser,
+) -> AppResult<impl IntoResponse> {
+    const PER_PAGE: u32 = 50;
+
+    let pagination = PaginationOptions {
+        page: Page::Numeric(q.page()),
+        per_page: PER_PAGE as i64,
+    };
+
+    conduit_compat(move || {
+        use crate::schema::{crates, users, versions};
+        use diesel::dsl::*;
+
+        let conn = &mut *app.db_read()?;
+
+        let mut query = versions::table
+            .inner_join(crates::table)
+            .inner_join(users::table)
+            .order(versions::created_at.desc())
+            .select((
+                versions::all_columns,
+                crate::models::krate::ALL_COLUMNS,
+                users::all_columns,
+            ))
+            .into_boxed();
+
+        if let Some(q_string) = q.query_string() {
+            // FIXME: this is stolen from the public search controller, and
+            // should be refactored into a common helper.
+            let q = sql::<TsQuery>("plainto_tsquery('english', ")
+                .bind::<Text, _>(q_string)
+                .sql(")");
+            query = query
+                .filter(
+                    q.clone()
+                        .matches(crates::textsearchable_index_col)
+                        .or(Crate::loosly_matches_name(q_string)),
+                )
+                // .select((Version::as_select(), Crate::as_select(), User::as_select()))
+                .order(Crate::with_name(q_string).desc())
+                .then_order_by(versions::created_at.desc());
+        }
+
+        let data: Paginated<(Version, Crate, User)> =
+            query.pages_pagination(pagination).load(conn)?;
+        Ok(render(&app.admin_engine, q.query_string(), data))
+    })
+    .await
+}
diff --git a/src/controllers/helpers/pagination.rs b/src/controllers/helpers/pagination.rs
index bdaba011dda..e19ae61d349 100644
--- a/src/controllers/helpers/pagination.rs
+++ b/src/controllers/helpers/pagination.rs
@@ -183,6 +183,25 @@ impl<T> Paginated<T> {
         Some(opts)
     }
 
+    pub(crate) fn current_page(&self) -> &Page {
+        &self.options.page
+    }
+
+    pub(crate) fn total_pages(&self) -> i64 {
+        let total = self.total();
+
+        if total <= self.options.per_page {
+            0
+        } else {
+            total / self.options.per_page
+                + (if total % self.options.per_page > 0 {
+                    1
+                } else {
+                    0
+                })
+        }
+    }
+
     pub(crate) fn iter(&self) -> impl Iterator<Item = &T> {
         self.records_and_total.iter().map(|row| &row.record)
     }
@@ -408,6 +427,56 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_paginated_page_calculation() {
+        let options = PaginationOptions {
+            page: Page::Numeric(1),
+            per_page: 50,
+        };
+
+        struct TestCase {
+            page_size: usize,
+            total: i64,
+            expected_total: i64,
+        }
+
+        for tc in [
+            TestCase {
+                page_size: 0,
+                total: 0,
+                expected_total: 0,
+            },
+            TestCase {
+                page_size: 10,
+                total: 10,
+                expected_total: 0,
+            },
+            TestCase {
+                page_size: 50,
+                total: 50,
+                expected_total: 0,
+            },
+            TestCase {
+                page_size: 50,
+                total: 100,
+                expected_total: 2,
+            },
+            TestCase {
+                page_size: 50,
+                total: 101,
+                expected_total: 3,
+            },
+        ] {
+            let rs = Paginated {
+                records_and_total: mock_resultset(tc.page_size, tc.total),
+                options: options.clone(),
+            };
+
+            assert_eq!(rs.current_page(), &options.page);
+            assert_eq!(rs.total_pages(), tc.expected_total);
+        }
+    }
+
     fn mock(query: &str) -> Request<()> {
         Request::builder()
             .method(Method::GET)
@@ -423,4 +492,10 @@ mod tests {
         let response = error.response();
         assert_eq!(StatusCode::BAD_REQUEST, response.status());
     }
+
+    fn mock_resultset(page_size: usize, total: i64) -> Vec<WithCount<usize>> {
+        (0..page_size)
+            .map(|i| WithCount { record: i, total })
+            .collect()
+    }
 }
diff --git a/src/controllers/version/yank.rs b/src/controllers/version/yank.rs
index 45313ee93a8..51571f5cfdf 100644
--- a/src/controllers/version/yank.rs
+++ b/src/controllers/version/yank.rs
@@ -63,7 +63,7 @@ fn modify_yank(
     let user = auth.user();
     let owners = krate.owners(conn)?;
 
-    if user.rights(state, &owners)? < Rights::Publish {
+    if user.rights(state, &owners)? < Rights::Publish && user.admin().is_err() {
         return Err(cargo_err("must already be an owner to yank or unyank"));
     }
 
diff --git a/src/extractors.rs b/src/extractors.rs
new file mode 100644
index 00000000000..92918b0982b
--- /dev/null
+++ b/src/extractors.rs
@@ -0,0 +1 @@
+pub mod admin;
diff --git a/src/extractors/admin.rs b/src/extractors/admin.rs
new file mode 100644
index 00000000000..4ebb51dc68d
--- /dev/null
+++ b/src/extractors/admin.rs
@@ -0,0 +1,43 @@
+use axum::{
+    async_trait,
+    extract::{FromRequestParts, State},
+};
+use http::request::Parts;
+
+use crate::{app::AppState, auth::AuthCheck, models, util::errors::BoxedAppError};
+
+/// An authorisation extractor that requires that the current user be a valid
+/// admin.
+///
+/// If there is no logged in user, or if the user isn't an admin, then a 403
+/// Forbidden will be returned without the controller being invoked.
+///
+/// Note that the ordering of extractors is often important: most notably, this
+/// extractor _must_ be used before any extractor that accesses the `Request` or
+/// `RequestParts`.
+#[derive(Debug)]
+pub struct AdminUser(pub models::user::AdminUser);
+
+#[async_trait]
+impl FromRequestParts<AppState> for AdminUser {
+    type Rejection = BoxedAppError;
+
+    async fn from_request_parts(
+        parts: &mut Parts,
+        state: &AppState,
+    ) -> Result<Self, Self::Rejection> {
+        let app = State::<AppState>::from_request_parts(parts, state)
+            .await
+            .expect("accessing AppState");
+        let conn = &mut *app.db_read_prefer_primary()?;
+
+        // TODO: allow other authentication methods, such as tokens.
+        // TODO: allow token scopes to be required.
+        Ok(Self(
+            AuthCheck::only_cookie()
+                .check(parts, conn)?
+                .user()
+                .admin()?,
+        ))
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
index b5ecbe055cb..4c4473c73ab 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -58,6 +58,7 @@ pub mod worker;
 
 pub mod auth;
 pub mod controllers;
+pub mod extractors;
 pub mod models;
 mod router;
 pub mod sentry;
diff --git a/src/middleware/ember_html.rs b/src/middleware/ember_html.rs
index 41e9f00b6ff..ffaa3e856f5 100644
--- a/src/middleware/ember_html.rs
+++ b/src/middleware/ember_html.rs
@@ -26,7 +26,7 @@ pub async fn serve_html<B: Send + 'static>(
     let path = &request.uri().path();
 
     // The "/git/" prefix is only used in development (when within a docker container)
-    if path.starts_with("/api/") || path.starts_with("/git/") {
+    if path.starts_with("/admin/") || path.starts_with("/api/") || path.starts_with("/git/") {
         next.run(request).await
     } else {
         if let Some(client) = &state.fastboot_client {
diff --git a/src/models/helpers.rs b/src/models/helpers.rs
index 8d9b9a43893..062d5a15eae 100644
--- a/src/models/helpers.rs
+++ b/src/models/helpers.rs
@@ -1 +1,2 @@
+pub mod admin;
 pub mod with_count;
diff --git a/src/models/helpers/admin.rs b/src/models/helpers/admin.rs
new file mode 100644
index 00000000000..699c1a771b4
--- /dev/null
+++ b/src/models/helpers/admin.rs
@@ -0,0 +1,81 @@
+use std::collections::HashSet;
+
+use lazy_static::lazy_static;
+
+use crate::util::errors::{forbidden, AppResult};
+
+lazy_static! {
+    static ref AUTHORIZED_ADMIN_USERS: HashSet<String> =
+        parse_authorized_admin_users(dotenv::var("GH_ADMIN_USERS"));
+}
+
+const DEFAULT_ADMIN_USERS: [&str; 3] = ["carols10cents", "jtgeibel", "Turbo87"];
+
+fn parse_authorized_admin_users(maybe_users: dotenv::Result<String>) -> HashSet<String> {
+    match maybe_users {
+        Ok(users) => users
+            .split(|c: char| !(c.is_ascii_alphanumeric() || c == '-'))
+            .filter(|user| !user.is_empty())
+            .map(String::from)
+            .collect(),
+        Err(_err) => DEFAULT_ADMIN_USERS.into_iter().map(String::from).collect(),
+    }
+}
+
+/// Return `Ok(())` if the given GitHub user name matches a known admin (set
+/// either via the `$GH_ADMIN_USERS` environment variable, or the builtin
+/// fallback list if that variable is unset), or a forbidden error otherwise.
+pub fn is_authorized_admin(username: &str) -> AppResult<()> {
+    // This hack is here to allow tests to have a consistent set of admin users
+    // (in this case, just the contents of the `DEFAULT_ADMIN_USERS` constant
+    // above).
+
+    #[cfg(not(test))]
+    fn check_username(username: &str) -> bool {
+        AUTHORIZED_ADMIN_USERS.contains(username)
+    }
+
+    #[cfg(test)]
+    fn check_username(username: &str) -> bool {
+        DEFAULT_ADMIN_USERS.contains(&username)
+    }
+
+    if check_username(username) {
+        Ok(())
+    } else {
+        Err(forbidden())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::{self, ErrorKind};
+
+    use super::{is_authorized_admin, parse_authorized_admin_users, DEFAULT_ADMIN_USERS};
+
+    #[test]
+    fn test_is_authorized_admin() {
+        assert_ok!(is_authorized_admin("Turbo87"));
+        assert_err!(is_authorized_admin(""));
+        assert_err!(is_authorized_admin("foo"));
+    }
+
+    #[test]
+    fn test_parse_authorized_admin_users() {
+        fn assert_authorized(input: dotenv::Result<&str>, expected: &[&str]) {
+            assert_eq!(
+                parse_authorized_admin_users(input.map(String::from)),
+                expected.iter().map(|s| String::from(*s)).collect()
+            );
+        }
+
+        assert_authorized(Ok(""), &[]);
+        assert_authorized(Ok("foo"), &["foo"]);
+        assert_authorized(Ok("foo, bar"), &["foo", "bar"]);
+        assert_authorized(Ok("   foo  bar "), &["foo", "bar"]);
+        assert_authorized(Ok("foo;bar"), &["foo", "bar"]);
+
+        let not_found_error = dotenv::Error::Io(io::Error::new(ErrorKind::NotFound, "not found"));
+        assert_authorized(Err(not_found_error), DEFAULT_ADMIN_USERS.as_slice());
+    }
+}
diff --git a/src/models/krate.rs b/src/models/krate.rs
index e4b1d540b60..9dca18912ee 100644
--- a/src/models/krate.rs
+++ b/src/models/krate.rs
@@ -28,7 +28,7 @@ pub struct RecentCrateDownloads {
     pub downloads: i32,
 }
 
-#[derive(Debug, Clone, Queryable, Identifiable, AsChangeset, QueryableByName)]
+#[derive(Debug, Clone, Queryable, Identifiable, AsChangeset, QueryableByName, Selectable)]
 #[diesel(table_name = crates)]
 pub struct Crate {
     pub id: i32,
diff --git a/src/models/user.rs b/src/models/user.rs
index 0073c9d8dec..26da42eaaba 100644
--- a/src/models/user.rs
+++ b/src/models/user.rs
@@ -6,11 +6,13 @@ use crate::app::App;
 use crate::email::Emails;
 use crate::util::errors::AppResult;
 
-use crate::models::{ApiToken, Crate, CrateOwner, Email, NewEmail, Owner, OwnerKind, Rights};
+use crate::models::{
+    helpers::admin, ApiToken, Crate, CrateOwner, Email, NewEmail, Owner, OwnerKind, Rights,
+};
 use crate::schema::{crate_owners, emails, users};
 
 /// The model representing a row in the `users` database table.
-#[derive(Clone, Debug, PartialEq, Eq, Queryable, Identifiable, AsChangeset)]
+#[derive(Clone, Debug, PartialEq, Eq, Queryable, Identifiable, AsChangeset, Selectable)]
 pub struct User {
     pub id: i32,
     pub gh_access_token: String,
@@ -177,4 +179,50 @@ impl User {
             .first(conn)
             .optional()
     }
+
+    /// Attempt to turn this user into an AdminUser
+    pub fn admin(&self) -> AppResult<AdminUser> {
+        AdminUser::new(self)
+    }
+}
+
+#[derive(Debug)]
+pub struct AdminUser(User);
+
+impl AdminUser {
+    pub fn new(user: &User) -> AppResult<Self> {
+        admin::is_authorized_admin(user.gh_login.as_str()).map(|_| Self(user.clone()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hardcoded_admins() {
+        let user = User {
+            id: 3,
+            gh_access_token: "arbitrary".into(),
+            gh_login: "literally_anything".into(),
+            name: None,
+            gh_avatar: None,
+            gh_id: 7,
+            account_lock_reason: None,
+            account_lock_until: None,
+        };
+        assert!(user.admin().is_err());
+
+        let sneaky_user = User {
+            gh_login: "carols10cents_plus_extra_stuff".into(),
+            ..user
+        };
+        assert!(sneaky_user.admin().is_err());
+
+        let real_real_real = User {
+            gh_login: "carols10cents".into(),
+            ..sneaky_user
+        };
+        assert!(real_real_real.admin().is_ok());
+    }
 }
diff --git a/src/models/version.rs b/src/models/version.rs
index d493f304289..7c29e558fc5 100644
--- a/src/models/version.rs
+++ b/src/models/version.rs
@@ -9,7 +9,7 @@ use crate::models::{Crate, Dependency, User};
 use crate::schema::*;
 
 // Queryable has a custom implementation below
-#[derive(Clone, Identifiable, Associations, Debug, Queryable, Deserialize, Serialize)]
+#[derive(Clone, Identifiable, Associations, Debug, Queryable, Selectable, Deserialize, Serialize)]
 #[diesel(belongs_to(Crate))]
 pub struct Version {
     pub id: i32,
diff --git a/src/router.rs b/src/router.rs
index 40a06fccd0c..6fe68037cf5 100644
--- a/src/router.rs
+++ b/src/router.rs
@@ -156,7 +156,10 @@ pub fn build_axum_router(state: AppState) -> Router {
         .route(
             "/api/github/secret-scanning/verify",
             post(github::secret_scanning::verify),
-        );
+        )
+        // Admin console
+        .route("/admin/", get(admin::index))
+        .route("/admin/crates/", get(admin::crates));
 
     // Only serve the local checkout of the git index in development mode.
     // In production, for crates.io, cargo gets the index from
diff --git a/src/views.rs b/src/views.rs
index 8b909b66e5b..dab4022314e 100644
--- a/src/views.rs
+++ b/src/views.rs
@@ -9,6 +9,8 @@ use crate::models::{
 };
 use crate::util::rfc3339;
 
+pub mod admin;
+
 pub mod krate_publish;
 pub use self::krate_publish::{EncodableCrateDependency, EncodableCrateUpload};
 
@@ -510,6 +512,7 @@ pub struct EncodablePrivateUser {
     pub email: Option<String>,
     pub avatar: Option<String>,
     pub url: Option<String>,
+    pub admin: bool,
 }
 
 impl EncodablePrivateUser {
@@ -520,6 +523,7 @@ impl EncodablePrivateUser {
         email_verified: bool,
         email_verification_sent: bool,
     ) -> Self {
+        let admin = user.admin().is_ok();
         let User {
             id,
             name,
@@ -538,6 +542,7 @@ impl EncodablePrivateUser {
             login: gh_login,
             name,
             url: Some(url),
+            admin,
         }
     }
 }
diff --git a/src/views/admin.rs b/src/views/admin.rs
new file mode 100644
index 00000000000..18b5115b530
--- /dev/null
+++ b/src/views/admin.rs
@@ -0,0 +1,2 @@
+pub mod crates;
+pub mod templating;
diff --git a/src/views/admin/crates.rs b/src/views/admin/crates.rs
new file mode 100644
index 00000000000..14248d099be
--- /dev/null
+++ b/src/views/admin/crates.rs
@@ -0,0 +1,59 @@
+use axum::response::IntoResponse;
+use axum_template::{engine::Engine, RenderHtml};
+use handlebars::Handlebars;
+
+use crate::{
+    controllers::helpers::pagination::Paginated,
+    models::{Crate, User, Version},
+};
+
+use super::templating::components;
+
+#[derive(Serialize)]
+struct View {
+    page: components::Page,
+    q: Option<String>,
+    versions: Vec<CrateVersion>,
+}
+
+#[derive(Serialize)]
+struct CrateVersion {
+    id: i32,
+    name: String,
+    num: String,
+    created_at: components::DateTime,
+    publisher: components::User,
+    yanked: bool,
+}
+
+impl CrateVersion {
+    fn new(version: Version, krate: Crate, user: User) -> Self {
+        Self {
+            id: version.id,
+            name: krate.name,
+            num: version.num,
+            created_at: version.created_at.into(),
+            publisher: user.into(),
+            yanked: version.yanked,
+        }
+    }
+}
+
+pub fn render(
+    engine: &Engine<Handlebars<'static>>,
+    q: Option<&str>,
+    page: Paginated<(Version, Crate, User)>,
+) -> impl IntoResponse {
+    RenderHtml(
+        "crates",
+        engine.clone(),
+        View {
+            q: q.map(|s| s.to_string()),
+            page: components::Page::new(&page, q),
+            versions: page
+                .into_iter()
+                .map(|(version, krate, user)| CrateVersion::new(version, krate, user))
+                .collect(),
+        },
+    )
+}
diff --git a/src/views/admin/templating.rs b/src/views/admin/templating.rs
new file mode 100644
index 00000000000..6eacabe4ae0
--- /dev/null
+++ b/src/views/admin/templating.rs
@@ -0,0 +1,112 @@
+use std::string::FromUtf8Error;
+
+use axum_template::engine::Engine;
+use handlebars::{handlebars_helper, Handlebars, TemplateError};
+use thiserror::Error;
+
+pub mod components;
+mod helpers;
+
+#[derive(rust_embed::RustEmbed)]
+#[folder = "admin/templates/"]
+struct Assets;
+
+pub fn engine() -> Result<Engine<Handlebars<'static>>, Error> {
+    let mut hbs = Handlebars::new();
+    hbs.set_strict_mode(true);
+
+    #[cfg(debug_assertions)]
+    configure_handlebars_debug(&mut hbs)?;
+
+    #[cfg(not(debug_assertions))]
+    configure_handlebars_release(&mut hbs)?;
+
+    handlebars_helper!(crate_index_path: |name: str| helpers::crate_index_path(name));
+    hbs.register_helper("crate-index-path", Box::new(crate_index_path));
+
+    Ok(Engine::from(hbs))
+}
+
+#[allow(dead_code)]
+fn configure_handlebars_debug(hbs: &mut Handlebars<'_>) -> Result<(), Error> {
+    hbs.set_dev_mode(true);
+    hbs.register_templates_directory(".hbs", "admin/templates")?;
+    Ok(())
+}
+
+#[allow(dead_code)]
+fn configure_handlebars_release(hbs: &mut Handlebars<'_>) -> Result<(), Error> {
+    // RustEmbed doesn't strip the `.hbs` extension from each template when
+    // using `Handlebars::register_embed_templates`, whereas
+    // `Handlebars::register_templates_directory` does. We'll walk the assets
+    // and register them individually to strip the extensions.
+    //
+    // In theory, we could do it the other way around in debug mode, but then
+    // the dev mode auto-reload wouldn't discover new templates without
+    // restarting the service.
+    for file in Assets::iter() {
+        let content = String::from_utf8(
+            Assets::get(&file)
+                .ok_or_else(|| Error::MissingFile(file.to_string()))?
+                .data
+                .into_owned(),
+        )
+        .map_err(|e| Error::MalformedContent(file.to_string(), e))?;
+
+        let name = file
+            .strip_suffix(".hbs")
+            .ok_or_else(|| Error::UnexpectedExtension(file.to_string()))?;
+
+        hbs.register_template_string(name, content)?;
+    }
+
+    Ok(())
+}
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("template {0} content is not valid UTF-8")]
+    MalformedContent(String, #[source] FromUtf8Error),
+
+    #[error("missing template file {0}")]
+    MissingFile(String),
+
+    #[error(transparent)]
+    Template(#[from] Box<TemplateError>),
+
+    #[error("template file {0} does not have the expected .hbs extension")]
+    UnexpectedExtension(String),
+}
+
+impl From<TemplateError> for Error {
+    fn from(value: TemplateError) -> Self {
+        // TemplateError is big, so we box it to avoid clippy warnings.
+        Self::Template(Box::new(value))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashSet;
+
+    use super::*;
+    use anyhow::Error;
+
+    #[test]
+    fn template_names_match_in_debug_and_release_modes() -> Result<(), Error> {
+        let mut debug = Handlebars::new();
+        debug.set_strict_mode(true);
+        configure_handlebars_debug(&mut debug)?;
+
+        let mut release = Handlebars::new();
+        release.set_strict_mode(true);
+        configure_handlebars_release(&mut release)?;
+
+        let debug_templates: HashSet<&String> = debug.get_templates().keys().collect();
+        let release_templates: HashSet<&String> = release.get_templates().keys().collect();
+
+        assert_eq!(debug_templates, release_templates);
+
+        Ok(())
+    }
+}
diff --git a/src/views/admin/templating/components.rs b/src/views/admin/templating/components.rs
new file mode 100644
index 00000000000..a525da47854
--- /dev/null
+++ b/src/views/admin/templating/components.rs
@@ -0,0 +1,8 @@
+mod datetime;
+pub use datetime::DateTime;
+
+mod page;
+pub use page::Page;
+
+mod user;
+pub use user::User;
diff --git a/src/views/admin/templating/components/datetime.rs b/src/views/admin/templating/components/datetime.rs
new file mode 100644
index 00000000000..77e01b51d79
--- /dev/null
+++ b/src/views/admin/templating/components/datetime.rs
@@ -0,0 +1,94 @@
+use chrono::{Duration, NaiveDateTime, Utc};
+use serde::{ser::SerializeMap, Serialize};
+
+#[derive(Debug, Clone, Copy)]
+pub struct DateTime(NaiveDateTime);
+
+impl From<NaiveDateTime> for DateTime {
+    fn from(value: NaiveDateTime) -> Self {
+        Self(value)
+    }
+}
+
+impl Serialize for DateTime {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        let mut map = serializer.serialize_map(Some(2))?;
+        map.serialize_entry("absolute", &format_time(self.0))?;
+        map.serialize_entry("human", &format_duration(Utc::now().naive_utc() - self.0))?;
+        map.end()
+    }
+}
+
+fn format_time(time: NaiveDateTime) -> String {
+    time.format("%a %-d %b %Y %H:%M:%S").to_string()
+}
+
+fn format_duration(duration: Duration) -> String {
+    // This originally delegated out to chrono-human-duration or
+    // pretty-duration, but the former had bugs around handling plurals and the
+    // latter could only handle std::time::Duration and didn't have any options
+    // to not include every unit. What we really need is so simple that it's
+    // easier to just implement it here.
+    let abs = if duration < Duration::zero() {
+        -duration
+    } else {
+        duration
+    };
+    let adverb = adverb(duration);
+
+    match (
+        abs.num_weeks(),
+        abs.num_days(),
+        abs.num_hours(),
+        abs.num_minutes(),
+        abs.num_seconds(),
+    ) {
+        (_, days, _, _, _) if days >= 365 => {
+            // Technically, leap years exist. Practically, it doesn't matter for
+            // a fuzzy duration anyway.
+            format!("{} year{} {}", days / 365, plural(days / 365), adverb)
+        }
+        (_, days, _, _, _) if days >= 30 => {
+            // Same for months, honestly.
+            format!("{} month{} {}", days / 30, plural(days / 30), adverb)
+        }
+        (weeks, _, _, _, _) if weeks > 0 => {
+            format!("{} week{} {}", weeks, plural(weeks), adverb)
+        }
+        (_, days, _, _, _) if days > 0 => {
+            format!("{} day{} {}", days, plural(days), adverb)
+        }
+        (_, _, hours, _, _) if hours > 0 => {
+            format!("{} hour{} {}", hours, plural(hours), adverb)
+        }
+        (_, _, _, minutes, _) if minutes > 0 => {
+            format!("{} minute{} {}", minutes, plural(minutes), adverb)
+        }
+        (_, _, _, seconds, _) if seconds > 0 => {
+            format!("{} second{} {}", seconds, plural(seconds), adverb)
+        }
+        _ => String::from("just now"),
+    }
+}
+
+fn plural(value: i64) -> &'static str {
+    if value == 1 {
+        ""
+    } else {
+        "s"
+    }
+}
+
+fn adverb(duration: Duration) -> &'static str {
+    // These durations are technically reversed; see the code in
+    // `DateTime::serialize` for the full details of how the durations are
+    // calculated.
+    if duration > Duration::zero() {
+        "ago"
+    } else {
+        "from now"
+    }
+}
diff --git a/src/views/admin/templating/components/page.rs b/src/views/admin/templating/components/page.rs
new file mode 100644
index 00000000000..92b68fcafa3
--- /dev/null
+++ b/src/views/admin/templating/components/page.rs
@@ -0,0 +1,80 @@
+use crate::controllers::helpers::pagination::{self, Paginated};
+use serde::{ser::SerializeMap, Serialize};
+
+#[derive(Debug, Clone)]
+pub struct Page {
+    current: u32,
+    total: u32,
+    q: Option<String>,
+}
+
+impl Page {
+    pub fn new<T>(resultset: &Paginated<T>, q: Option<&str>) -> Self {
+        Self {
+            current: if let pagination::Page::Numeric(n) = resultset.current_page() {
+                *n
+            } else {
+                // We just don't support seek pagination right now in the admin, and if it's not
+                // specific, we want to default to 1 regardless.
+                1
+            },
+            total: resultset.total_pages() as u32,
+            q: q.map(|s| s.to_string()),
+        }
+    }
+
+    fn page_url(&self, page: u32) -> String {
+        use url::form_urlencoded::Serializer;
+
+        let mut s = Serializer::new(String::from("?"));
+        s.append_pair("page", &page.to_string());
+        if let Some(q) = &self.q {
+            s.append_pair("q", q);
+        }
+        s.finish()
+    }
+}
+
+impl Serialize for Page {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        #[derive(Serialize)]
+        struct PageView {
+            number: u32,
+            active: bool,
+            url: String,
+        }
+
+        let mut map = serializer.serialize_map(Some(4))?;
+        map.serialize_entry("paginated", &(self.total > 1))?;
+        map.serialize_entry(
+            "previous",
+            &if self.current < 2 {
+                None
+            } else {
+                Some(self.page_url(self.current - 1))
+            },
+        )?;
+        map.serialize_entry(
+            "next",
+            &if self.current >= self.total {
+                None
+            } else {
+                Some(self.page_url(self.current + 1))
+            },
+        )?;
+        map.serialize_entry(
+            "pages",
+            &((1..=self.total)
+                .map(|page| PageView {
+                    number: page,
+                    active: page == self.current,
+                    url: self.page_url(page),
+                })
+                .collect::<Vec<_>>()),
+        )?;
+        map.end()
+    }
+}
diff --git a/src/views/admin/templating/components/user.rs b/src/views/admin/templating/components/user.rs
new file mode 100644
index 00000000000..481b516a0a3
--- /dev/null
+++ b/src/views/admin/templating/components/user.rs
@@ -0,0 +1,18 @@
+use crate::models;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct User {
+    id: i32,
+    avatar: Option<String>,
+    username: String,
+}
+
+impl From<models::User> for User {
+    fn from(value: models::User) -> Self {
+        Self {
+            id: value.id,
+            avatar: value.gh_avatar,
+            username: value.gh_login,
+        }
+    }
+}
diff --git a/src/views/admin/templating/helpers.rs b/src/views/admin/templating/helpers.rs
new file mode 100644
index 00000000000..362301c9ab5
--- /dev/null
+++ b/src/views/admin/templating/helpers.rs
@@ -0,0 +1,9 @@
+use cargo_registry_index::Repository;
+
+pub(super) fn crate_index_path(name: &str) -> String {
+    String::from(
+        Repository::relative_index_file(name)
+            .to_str()
+            .expect("invalid UTF-8 in crate name"),
+    )
+}