diff --git a/.bw-password.asc b/.bw-password.asc
new file mode 100644
index 0000000..eb3ecb4
--- /dev/null
+++ b/.bw-password.asc
@@ -0,0 +1,6 @@
+-----BEGIN PGP MESSAGE-----
+
+jA0ECQMIAdvrnwZA6vH/0k4BbpJaxRE/WBrPHh/+FEz76PXX3zGkiu+ETcqKY10+
+RX68z4fcbzxK3nWltb8k7TPjjgLgUkoAYJD7wGVp/v7tijhWcfyH5/sS+lF80ao=
+=1IPu
+-----END PGP MESSAGE-----
diff --git a/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl b/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl
new file mode 100644
index 0000000..0028806
--- /dev/null
+++ b/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl
@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+
+BW_PASSWORD={{ joinPath .chezmoi.sourceDir ".bw-password.asc" | include | decrypt }}
+BW_SESSION="$(bw unlock "$BW_PASSWORD" --raw)"
+export BW_SESSION