diff --git a/bin/pwenv b/bin/pwenv
new file mode 100755
index 0000000..408e09d
--- /dev/null
+++ b/bin/pwenv
@@ -0,0 +1,7 @@
+#!/bin/bash
+set -eu
+
+var="$1"
+shift
+
+exec env ${var}=$(systemd-ask-password --accept-cached --keyname="pwenv.${var}" "${var}: ") "$@"