diff --git a/tools/nixops.sh b/tools/nixops.sh
new file mode 100755
index 0000000..c7a9769
--- /dev/null
+++ b/tools/nixops.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# A wrapper around real nixops to decrypt GCP secret.
+
+if [ -z "$hscloud_root" ]; then
+   echo 2>&1 "Please source env.sh"
+   exit 1
+fi
+
+for f in sa.json; do
+    plain="$hscloud_root/gcp/secrets/plain/sa.json"
+    cipher="$hscloud_root/gcp/secrets/cipher/sa.json"
+    if [ ! -f "$plain" ]; then
+        secretstore decrypt "$cipher" > "$plain"
+    fi
+done
+
+nixops.bin "$@"