diff --git a/tools/nixops.sh b/tools/nixops.sh
index c7a9769..f3848d2 100755
--- a/tools/nixops.sh
+++ b/tools/nixops.sh
@@ -7,12 +7,16 @@
    exit 1
 fi
 
-for f in sa.json; do
-    plain="$hscloud_root/gcp/secrets/plain/sa.json"
-    cipher="$hscloud_root/gcp/secrets/cipher/sa.json"
+for f in sa.json sa.pem; do
+    plain="$hscloud_root/gcp/secrets/plain/$f"
+    cipher="$hscloud_root/gcp/secrets/cipher/$f"
     if [ ! -f "$plain" ]; then
         secretstore decrypt "$cipher" > "$plain"
     fi
 done
 
+export GCE_PROJECT="hscloud"
+export GCE_SERVICE_ACCOUNT="nixops@hscloud.iam.gserviceaccount.com"
+export ACCESS_KEYPATH="$hscloud_root/gcp/secrets/plain/sa.pem"
+
 nixops.bin "$@"