diff --git a/scripts/mount-sshfs@.service b/etc/systemd/user/mount-sshfs@.service
similarity index 100%
rename from scripts/mount-sshfs@.service
rename to etc/systemd/user/mount-sshfs@.service
diff --git a/scripts/mount-veracrypt@.service b/etc/systemd/user/mount-veracrypt@.service
similarity index 65%
rename from scripts/mount-veracrypt@.service
rename to etc/systemd/user/mount-veracrypt@.service
index 7d0c7c5..73dbd64 100644
--- a/scripts/mount-veracrypt@.service
+++ b/etc/systemd/user/mount-veracrypt@.service
@@ -1,6 +1,7 @@
 [Unit]
 Description=Mount veracrypt volume for %i
 
+# TODO these scripts moved
 [Service]
 Type=forking
 ExecStart=%h/.bin/mount.veracrypt ${BW_NAME} ${VOLUME} ${MOUNTPOINT}
diff --git a/scripts/runtime_pkgs b/runtime_pkgs
similarity index 100%
rename from scripts/runtime_pkgs
rename to runtime_pkgs
diff --git a/scripts/gpg b/scripts/gpg
new file mode 100755
index 0000000..facaa97
--- /dev/null
+++ b/scripts/gpg
@@ -0,0 +1,5 @@
+#! /bin/bash
+
+## gpg (override): mount GNUPGHOME before executing
+
+with_gpg_mount /usr/bin/gpg "$@"
diff --git a/scripts/mount.veracrypt b/scripts/mount.veracrypt
new file mode 100755
index 0000000..4853b86
--- /dev/null
+++ b/scripts/mount.veracrypt
@@ -0,0 +1,30 @@
+#! /bin/bash
+
+## mount a veracrypt volume
+
+## NOTE this will need the DISPLAY variable in order to prompt for the bitwarden
+## password
+pwd=$(dbus-send --print-reply=literal --session \
+                --dest=org.rofi.bitwarden \
+                /bitwarden org.rofi.bitwarden.session.GetPassword \
+                string:"$1" | \
+          sed -e 's/^ *//g')
+
+## the funny evals are here to expand any literal env variables that may be
+## passed because systemd didn't expand them (yuck)
+volume="$(eval echo "$2")"
+mountpoint="$(eval echo "$3")"
+
+if [[ "$pwd" == "" ]]; then
+    echo "Could not get bitwarden password"
+    exit 1
+else
+    if /usr/bin/sudo /usr/bin/veracrypt \
+                     --text --non-interactive --stdin \
+                     "$volume" "$mountpoint" <<< "$pwd"; then
+        echo "Mounted $1"
+    else
+        echo "Failed to mount $1"
+        exit 1
+    fi
+fi
diff --git a/scripts/pass b/scripts/pass
new file mode 100755
index 0000000..7e81ddd
--- /dev/null
+++ b/scripts/pass
@@ -0,0 +1,5 @@
+#! /bin/bash
+
+## pass (override): mount $GNUPGHOME before executing
+
+with_gpg_mount /usr/bin/pass "$@"
diff --git a/scripts/umount.veracrypt b/scripts/umount.veracrypt
new file mode 100755
index 0000000..939a4c6
--- /dev/null
+++ b/scripts/umount.veracrypt
@@ -0,0 +1,14 @@
+#! /bin/bash
+
+## unmount a veracrypt volume
+
+## the funny evals are here to expand any literal env variables that may be
+## passed because systemd didn't expand them (yuck)
+mountpoint="$(eval echo "$1")"
+
+if /usr/bin/sudo /usr/bin/veracrypt -d "$mountpoint"; then
+    echo "Unmounted $1"
+else
+    echo "Failed to unmount $1"
+    exit 1
+fi
diff --git a/scripts/with_gpg_mount b/scripts/with_gpg_mount
new file mode 100755
index 0000000..33d2e91
--- /dev/null
+++ b/scripts/with_gpg_mount
@@ -0,0 +1,14 @@
+#! /bin/bash
+
+## with_gpg_mount: call a program after mounting GNUPGHOME using rofi
+
+bin="$1"
+shift
+
+alias="gnupg"
+
+if rofi-dev -c "$XDG_CONFIG_HOME/rofi/devices.dhall" -m "$alias"; then
+    "$bin" "$@"
+else
+    echo "Could not mount $alias"
+fi