diff --git a/.gitignore b/.gitignore
index 4e96927..6a9c6f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
+/.vault-secret.gpg
 .fact-cache
diff --git a/.vault-secret.sh b/.vault-secret.sh
new file mode 100755
index 0000000..e6d90b1
--- /dev/null
+++ b/.vault-secret.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec gpg --quiet --batch --decrypt "${0%.sh}.gpg"
diff --git a/ansible.cfg b/ansible.cfg
index 8861b32..a0b6ba4 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -6,3 +6,5 @@ inventory = hosts
 gathering = smart
 fact_caching = jsonfile
 fact_caching_connection = .fact-cache
+
+vault_password_file = .vault-secret.sh