diff --git a/vault b/vault
index abb071d..67e51e0 100755
--- a/vault
+++ b/vault
@@ -1,38 +1,38 @@
 #!/bin/sh
 set -e
 
-FILES_IN_VAULT='./src/wifi-password.txt
-./src/repository-builder/packager.rsa
-./src/repository-builder/packager.rsa.pub
-./src/wireguard.private.key
-./src/wireguard.public.key
-./src/authorized_keys'
+FILES_IN_VAULT=$(find . -name *.age)
 
 age_encrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --encrypt --passphrase --armor --output $output $input && rm $input && mv $output $input
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --encrypt --passphrase --armor --output "$2" "$1"
 }
 
 age_decrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --decrypt --output $output $input && rm $input && mv $output $input
+  BASENAME=$(basename $1 .age)
+
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --decrypt --output "secrets/$BASENAME" "$1"
 }
 
+
 encrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_encrypt $FILE
+    age_encrypt "$FILE"
   done
 }
 
 decrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_decrypt $FILE
+    age_decrypt "$FILE"
   done
 }