diff --git a/modules/ecryptfs.nix b/modules/ecryptfs.nix
index 81934a7..c54c93e 100644
--- a/modules/ecryptfs.nix
+++ b/modules/ecryptfs.nix
@@ -1,6 +1,21 @@
 { pkgs, ... }: {
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; let
+    unlock-database-script = writeScriptBin "unlock-database-encryption"
+      ''
+        if [ $UID -ne 0 ]; then
+          echo "unlock-database-encryption must be run as root"
+          exit 1
+        fi
+        ECRYPTFS_SIG=$(( stty -echo; printf "Passphrase: " 1>&2; read PASSWORD; stty echo; echo $PASSWORD; ) | ecryptfs-insert-wrapped-passphrase-into-keyring ~/.ecryptfs/wrapped-passphrase - | sed -nr 's/.*\[(.*)\].*/\1/p')
+
+        keyctl link @u @s
+
+        mount -i -t ecryptfs /var/db/.mongodb-encrypted/ /var/db/mongodb -o ecryptfs_sig=$ECRYPTFS_SIG,ecryptfs_fnek_sig=$ECRYPTFS_SIG,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_unlink_sigs
+      '';
+  in
+  [
     ecryptfs
     keyutils
+    unlock-database-script
   ];
 }