diff --git a/CHANGES.md b/CHANGES.md
index 77d6b06..271bbf5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -2,6 +2,8 @@
 
 ## 3.0.1 (not yet released)
 
+- #54 `triton rbac role-tags` for now can't be hidden (as long we have the
+  need to role-tag raw resource URLs like '/my/images').
 - #54 `triton rbac apply --dev-create-keys-and-profiles` for
   experimenting/dev/testing to quickly generate and add user keys and setup
   Triton CLI profiles for all users in the RBAC config.
diff --git a/lib/do_rbac/do_role_tags.js b/lib/do_rbac/do_role_tags.js
index a0c6edc..c84858e 100644
--- a/lib/do_rbac/do_role_tags.js
+++ b/lib/do_rbac/do_role_tags.js
@@ -7,7 +7,7 @@
 /*
  * Copyright 2015 Joyent, Inc.
  *
- * `triton rbac role-tags ...`    # hidden lower-level command
+ * `triton rbac role-tags ...`
  * `triton rbac instance-role-tags ...`
  * `triton rbac image-role-tags ...`
  * `triton rbac package-role-tags ...`
@@ -596,7 +596,6 @@ var do_role_tags = makeRoleTagsFunc({
     argName: 'RESOURCE-URL',
     helpArgIs: 'an RBAC resource URL'
 });
-do_role_tags.hidden = true;
 
 var do_instance_role_tags = makeRoleTagsFunc({
     resourceType: 'instance',
diff --git a/lib/do_rbac/index.js b/lib/do_rbac/index.js
index 5a8a1fa..d7ba049 100644
--- a/lib/do_rbac/index.js
+++ b/lib/do_rbac/index.js
@@ -48,7 +48,8 @@ function RbacCLI(top) {
             'instance-role-tags',
             'image-role-tags',
             'network-role-tags',
-            'package-role-tags'
+            'package-role-tags',
+            'role-tags'
         ]
     });
 }