diff --git a/pkgs/default.nix b/pkgs/default.nix
index cdde65d..2864369 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -9,4 +9,5 @@
   hwi = pkgs.callPackage ./hwi { };
   pylightning = pkgs.python3Packages.callPackage ./pylightning { };
   liquid-swap = pkgs.python3Packages.callPackage ./liquid-swap { };
+  generate-secrets = pkgs.callPackage ./generate-secrets { };
 }
diff --git a/pkgs/generate-secrets/default.nix b/pkgs/generate-secrets/default.nix
new file mode 100644
index 0000000..8222057
--- /dev/null
+++ b/pkgs/generate-secrets/default.nix
@@ -0,0 +1,6 @@
+{ pkgs }: with pkgs;
+
+writeScript "generate-secrets" ''
+  export PATH=${lib.makeBinPath [ coreutils apg openssl ]}
+  . ${./generate-secrets.sh} ${./openssl.cnf}
+''
diff --git a/secrets/generate_secrets.sh b/pkgs/generate-secrets/generate-secrets.sh
similarity index 100%
rename from secrets/generate_secrets.sh
rename to pkgs/generate-secrets/generate-secrets.sh
diff --git a/secrets/openssl.cnf b/pkgs/generate-secrets/openssl.cnf
similarity index 100%
rename from secrets/openssl.cnf
rename to pkgs/generate-secrets/openssl.cnf
diff --git a/shell.nix b/shell.nix
index 3a4c7b5..769a8e8 100644
--- a/shell.nix
+++ b/shell.nix
@@ -7,8 +7,9 @@ stdenv.mkDerivation rec {
   name = "nix-bitcoin-environment";
 
   nixops19_09 = callPackage ./pkgs/nixops {};
+  generate-secrets = callPackage ./pkgs/generate-secrets {};
 
-  buildInputs = with pkgs; [ nixops19_09 figlet apg openssl ];
+  buildInputs = [ nixops19_09 figlet ];
 
   shellHook = ''
     export NIX_PATH="nixpkgs=${nixpkgs}:."
@@ -18,6 +19,6 @@ stdenv.mkDerivation rec {
     # keys already added to my ssh-agent.
     export SSH_AUTH_SOCK=""
     figlet "nix-bitcoin"
-    (cd secrets; ./generate_secrets.sh)
+    (mkdir -p secrets; cd secrets; ${generate-secrets})
   '';
 }