diff --git a/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl b/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl
index 0028806..cc795e8 100644
--- a/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl
+++ b/.chezmoiscripts/run_before_10-unlock-bw.sh.tmpl
@@ -1,5 +1,7 @@
 #!/usr/bin/env sh
 
 BW_PASSWORD={{ joinPath .chezmoi.sourceDir ".bw-password.asc" | include | decrypt }}
-BW_SESSION="$(bw unlock "$BW_PASSWORD" --raw)"
+export BW_PASSWORD
+
+BW_SESSION="$(bw unlock --password-env BW_PASSWORD --raw)"
 export BW_SESSION