diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl
index 974e201..2bde8ab 100644
--- a/.chezmoi.toml.tmpl
+++ b/.chezmoi.toml.tmpl
@@ -1,3 +1,9 @@
+encryption = "age"
+
+[age]
+	identity = "~/.config/chezmoi/key.txt"
+	recipient = "age1lvg9zu6sj5pa4qr5zucjerm8a08v6pyls9ffxz25y0vftcfhmv4qxhfl7y"
+
 [git]
 	autoCommit = true
 	autoPush = true
diff --git a/.chezmoiignore b/.chezmoiignore
new file mode 100644
index 0000000..b022973
--- /dev/null
+++ b/.chezmoiignore
@@ -0,0 +1 @@
+key.txt.age
diff --git a/key.txt.age b/key.txt.age
new file mode 100644
index 0000000..f72ed5c
--- /dev/null
+++ b/key.txt.age
@@ -0,0 +1,10 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCBZem92UzN2RWRLa01VVE4r
+TVVPMWp3IDE2Ckx6ZmliRTRTMkg1YlVKU2R6dklQeVFDUFhiUEZieUhXR1NZUWVO
+Zy9KZGMKLS0tIGw4dWt0Q2xXbkRITlhzYzFoVFBtTzI1cGppQVgyaWNhSFBKcU9I
+dXZqRU0KEMzE9RVyldr4XH0CZogdJ01wPBBhEB3FcbcUhuJdBJODKffACm5OzZfS
+5/MA3s673rAMY/UlfE6HIn/1ru26PMYgqZR/gfRJtrzdydYrYczBhzXLjqpXJaY2
+0bec1ygoxeNJ+FPIMPAQzKyV5sZ5O3gpKAxsD06ttGdmelMVr8h9a7WrNljyDIkV
+HLTZMhD/asthkLdsLZru4yLXgMUHagMSxP4JLuw01A7eh5dlc7KQrs8vs1s/utqL
+JXZvFMZxn+PIO/J2gfmJppoBY6cTajY2cTN18vy9tz5XNUE=
+-----END AGE ENCRYPTED FILE-----
diff --git a/run_onchange_before_decrypt-private-key.sh.tmpl b/run_onchange_before_decrypt-private-key.sh.tmpl
new file mode 100644
index 0000000..ac50932
--- /dev/null
+++ b/run_onchange_before_decrypt-private-key.sh.tmpl
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ ! -f "${HOME}/.config/chezmoi/key.txt" ]; then
+    mkdir -p "${HOME}/.config/chezmoi"
+    chezmoi age decrypt --output "${HOME}/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age"
+    chmod 600 "${HOME}/.config/chezmoi/key.txt"
+fi
+