diff --git a/key.txt.age b/.assets/key.txt.age
similarity index 100%
rename from key.txt.age
rename to .assets/key.txt.age
diff --git a/run_once_before_decrypt-private-key.sh.tmpl b/run_once_before_decrypt-private-key.sh.tmpl
new file mode 100644
index 0000000..9ba1588
--- /dev/null
+++ b/run_once_before_decrypt-private-key.sh.tmpl
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ ! -f "${HOME}/.config/chezmoi/key.txt" ]; then
+    mkdir -p "${HOME}/.config/chezmoi"
+    chezmoi age decrypt --output "${HOME}/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/.assets/key.txt.age"
+    chmod 600 "${HOME}/.config/chezmoi/key.txt"
+fi