diff --git a/run_before_decrypt-private-key.sh.tmpl b/run_before_decrypt-private-key.sh.tmpl
new file mode 100644
index 0000000..dbffe10
--- /dev/null
+++ b/run_before_decrypt-private-key.sh.tmpl
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ ! -f "${HOME}/.config/chezmoi/key.txt" ]; then
+    mkdir -p "${HOME}/.config/chezmoi"
+    chezmoi age decrypt --output "${HOME}/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age"
+    chmod 600 "${HOME}/.config/chezmoi/key.txt"
+fi