diff --git a/.travis.yml b/.travis.yml
index 10e1814f..88dd5093 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,10 +15,7 @@ install:
   - go clean -i net
   - go install -tags netgo std
   - pip install --user --upgrade gcloud gsutil
-  - openssl aes-256-cbc
-    -K $encrypted_5ba036e89377_key -iv $encrypted_5ba036e89377_iv
-    -in bin/setup-ci-secrets.enc -out bin/setup-ci-secrets -d
-  - chmod +x bin/setup-ci-secrets
+  - bin/setup-ci-secrets $encrypted_5ba036e89377_key $encrypted_5ba036e89377_iv
   - make travis
 
 script:
@@ -28,5 +25,4 @@ script:
 after_success:
   - go get github.com/mattn/goveralls
   - $HOME/gopath/bin/goveralls -coverprofile=profile.cov -service=travis-ci
-  - bin/setup-ci-secrets
   - site/build-and-publish.sh
diff --git a/bin/setup-ci-secrets b/bin/setup-ci-secrets
new file mode 100755
index 00000000..3bd2ae20
--- /dev/null
+++ b/bin/setup-ci-secrets
@@ -0,0 +1,57 @@
+#!/bin/sh
+
+## This is the shape of unencrypted `do-setup-ci-secrets`
+## 
+## cat > /tmp/boto_gsutil_cert.pem << EOF
+## -----BEGIN PRIVATE KEY-----
+## <...>
+## -----END PRIVATE KEY-----
+## EOF
+## 
+## cat > ~/.boto << EOF
+## [Credentials]
+## gs_service_client_id = <...>
+## gs_service_key_file = /tmp/boto_gsutil_cert.pem
+## 
+## [Boto]
+## https_validate_certificates = True
+## 
+## [GSUtil]
+## content_language = en
+## default_api_version = 2
+## default_project_id = <...>
+## EOF
+
+openssl base64 -d << EOF \
+  | openssl aes-256-cbc -d -K $1 -iv $2 \
+    -out bin/do-setup-ci-secrets
+mOYNzNsAdwva0LbB2YFMY9VgL0SITFu1bPrbOujyLtOrBNjmOYbzR5d/sG+ARMFr
+7NZ5OKcvMbItllz0n7TtNkzkCOMztMC870Wcx3nGJzbBephdcYwos4tBlp5bihTU
+AXgxLUiDT1broYAFKnbE1aZC/XyNxuLTN+nXJWIWeijaXTgvhkEEm3tab+z7ioCb
+tlg71W1BrUuocctAJAuVwH/uTZAaXaJGJj1s2S7F2DrFnG6sFlrp8rnCucPLWKnC
+4IwJFC5saR5gxK6wECffwmwbpeXVOoQ58OgzxoZTEyAr9nhVbaBt5UZz3tfHlx8W
+Rn5jHehACw5kg5eMtGPqMEksJ63LX4h3mfSTLJXJHEmOrzCRpFrigVrsbA408U2u
+8jJTHJmKrGfwBh5ZFzBg6NuV4VplOp+ZquJLgegv2WH/iu/ciopXqB2YDCdx5ZBi
+nHV2Puth7kjS4EMCKUGfeqpesjL9Djb8cygzv/J3ZBmLjNH9dqlSXWy2DcFZA1Iy
+pFTTHkVU3w5sNz3nYOuT2UPQvULBW0FUndDKX6olyVa0mlxPwGBP9N3yGg918/rw
+7rNV/r54lA334F5QMhDrVxar6sl9wfLA+Z+8qemBbNFlLog1uQGhuwWK2nFu1tRM
+9uyvQIq0oq5NHKpogWc7NEuk7CPe1JyfRIcbMVj8+ilmKjUPB2HPC43IDmKt9/56
+rY3IXAcxZ/ClGfGpeNHXqop9T/WhfaowponOZFcdGSUddG0OswqkTE4KIv71mgTF
+jXooMkTQBOG+gBnCe+8bCRdRCG3anxHX74za4dGD58cOJtl6DYWnjWuR91NWnxdT
+1Zr3iUe41txg9hCNY9LHo2QHGLPxe6pmNnSClQ1mcFhuY6NF8RmCX3HAGKJQkxJb
+vpLGbXTXjAIFgIYgLNgKP2RLvCif/LmSWgkvE3ZU9GXtCUbm6xgJodwOqXiI9uuO
+4H4+/vpGHnSFENiclkgMFrLG4yiMu8ArgmnCBzg9E2AoOX5zCrh/2ZRTU8Dk4mt7
+jUd5SKQLsjB9QtB+y3tRO7zY9RDvR6iBOPRsjx6t8EJMCfPb06KchfMJw+VGxvMM
+48jtmepREFnhd/8XDRGnw5bznjRuwohGik8BToltjIviMkkpifKWaLwlaOiDXaHh
+VBFNXnUKvOBwRMU+PZqv4+DP2qff1gSXnGKqA5GIURYrK9P7TqHHNTnmjBdfJLzc
+0x+W1DTiYhLT2vrLrkEpZ99o6qrg+lwvjat6IsJF8xoQEo4pLD/ZRPJ0WzoDyctT
+oWZ5rMsN1TzTvJrBrTAWIJyhIzZcuNwChMrU6qogMr0fd6TSxWhWn0sOJ5y8AaTR
+ej4JHx0qroS/9JPmgFYU61pX3c0ypdef/sSHWG23mcFzLTgwe2d4ty9VakypZy3T
+sXCl6EHVVXlUFWhY4zQCjdZpYJv/rtoKL1BL4fPE2NV5WTjCL2GNvaO5SfHR7pA0
+yQJR/iU+cS2n8UXsWNjyV+/qEn6+QXuyVHGLbxyH8EeqlliAbyHsc2rzVI8Xctzo
+W5DuIqxwHAkNNurhmx27ktIIQ6HhaCp028SWwvLttkbBBgF4v1mmd4u/2bKbKjUd
+dOaetaIUx1hU9OAeaePvVkeTDcc3mlFtPARCS9Fqj16hgJQ43onZyC0H1K2WAxmU
+GsmzjCHlTNquzFTuuQihYGZKfsWIh9z6HEOkvNJ3VEQ=
+EOF
+
+exec sh bin/do-setup-ci-secrets
diff --git a/bin/setup-ci-secrets.enc b/bin/setup-ci-secrets.enc
deleted file mode 100644
index b9d25c24..00000000
Binary files a/bin/setup-ci-secrets.enc and /dev/null differ
diff --git a/bin/setup-ci-secrets.readme b/bin/setup-ci-secrets.readme
deleted file mode 100644
index 16b37e81..00000000
--- a/bin/setup-ci-secrets.readme
+++ /dev/null
@@ -1,21 +0,0 @@
-This is the shape of unencrypted `setup-ci-secrets`
-
-cat > /tmp/boto_gsutil_cert.pem << EOF
------BEGIN PRIVATE KEY-----
-<...>
------END PRIVATE KEY-----
-EOF
-
-cat > ~/.boto << EOF
-[Credentials]
-gs_service_client_id = <...>
-gs_service_key_file = /tmp/boto_gsutil_cert.pem
-
-[Boto]
-https_validate_certificates = True
-
-[GSUtil]
-content_language = en
-default_api_version = 2
-default_project_id = <...>
-EOF