diff --git a/install.sh b/install.sh
new file mode 100644
index 0000000..7c3305d
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+install -m 0755 -o root -g root tpm-unseal-password.sh /usr/local/sbin/tpm-unseal-password.sh
+install -m 0755 -o root -g root tpm-bootstrap-1password.sh /usr/local/sbin/tpm-bootstrap-1password.sh
+install -m 0755 -o root -g root vault-tpm2-unseal.sh /usr/local/sbin/vault-tpm2-unseal.sh
+install -m 0644 -o root -g root vault-tpm2-unseal.service /etc/systemd/system/vault-tpm2-unseal.service
+systemctl daemon-reload
+systemctl enable vault-tpm2-unseal.service
diff --git a/vault-tpm2-unseal.sh b/vault-tpm2-unseal.sh
index d30bf61..e2ea750 100755
--- a/vault-tpm2-unseal.sh
+++ b/vault-tpm2-unseal.sh
@@ -12,6 +12,11 @@
 
 set -euo pipefail
 
+CONFIG="/etc/vault.d/tpm2.env"
+if [ -r "$CONFIG" ]; then
+	set -a; . "$CONFIG"; set +a
+fi
+
 : "${VAULT_ADDR:?VAULT_ADDR must be set}"
 TPM_UNSEAL_SCRIPT="${TPM_UNSEAL_SCRIPT:-/usr/local/sbin/tpm-unseal-password.sh}"
 TPM_HANDLE="${TPM_HANDLE:-0x81010001}"