diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl
index b2c2d72..040c423 100644
--- a/.chezmoi.toml.tmpl
+++ b/.chezmoi.toml.tmpl
@@ -9,9 +9,6 @@
 progress = true
 encryption = "gpg"
 
-[git]
-autoPush = true
-
 [diff]
 {{ if lookPath "delta" -}}
 command = "delta"
@@ -24,6 +21,12 @@ exclude = ["scripts"]
 symmetric = true
 args = ["--batch", "--passphrase", {{ $passphrase | quote }}, "--no-symkey-cache"]
 
+[git]
+autoPush = true
+
+[hooks.read-source-state.pre]
+command = ".local/share/chezmoi/.install-bw.sh"
+
 [data]
 {{ if lookPath "get-gpg-key" -}}
 gpgKey = {{ output "get-gpg-key" | trim | quote }}
diff --git a/.install-bw.sh b/.install-bw.sh
new file mode 100644
index 0000000..09d9428
--- /dev/null
+++ b/.install-bw.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+
+type bw >/dev/null 2>&1 && exit
+
+case "$(uname -s)" in
+Darwin)
+	brew install bitwarden-cli
+	;;
+Linux)
+	if command -v yay 2>&1; then
+		yay -S bitwarden-cli
+	elif command -v pacman 2>&1; then
+		pacman -S bitwarden-cli
+	elif command -v npm 2>&1; then
+		npm install -g @bitwarden/cli
+	else
+		echo "unsupported OS"
+		exit 1
+	fi
+	;;
+esac
diff --git a/private_dot_ssh/private_id_ed25519.pub.tmpl b/private_dot_ssh/private_id_ed25519.pub.tmpl
index 28a8dcc..2eb6ac4 100644
--- a/private_dot_ssh/private_id_ed25519.pub.tmpl
+++ b/private_dot_ssh/private_id_ed25519.pub.tmpl
@@ -1 +1,3 @@
-{{- bitwardenAttachment "id_ed25519.pub" "a551a692-b06a-49c0-9aa6-b16001875eed" -}}
+{{- if not (stat (joinPath .chezmoi.homeDir ".ssh/id_ed25519.pub")) -}}
+  {{- bitwardenAttachment "id_ed25519.pub" "a551a692-b06a-49c0-9aa6-b16001875eed" -}}
+{{- end -}}
diff --git a/private_dot_ssh/private_id_ed25519.tmpl b/private_dot_ssh/private_id_ed25519.tmpl
index 5c4a520..c780211 100644
--- a/private_dot_ssh/private_id_ed25519.tmpl
+++ b/private_dot_ssh/private_id_ed25519.tmpl
@@ -1 +1,3 @@
-{{- bitwardenAttachment "id_ed25519" "a551a692-b06a-49c0-9aa6-b16001875eed" -}}
+{{- if not (stat (joinPath .chezmoi.homeDir ".ssh/id_ed25519")) -}}
+  {{- bitwardenAttachment "id_ed25519" "a551a692-b06a-49c0-9aa6-b16001875eed" -}}
+{{- end -}}