diff --git a/home/.chezmoi.toml.tmpl b/home/.chezmoi.toml.tmpl
index bfefb2a..d599015 100644
--- a/home/.chezmoi.toml.tmpl
+++ b/home/.chezmoi.toml.tmpl
@@ -56,5 +56,9 @@ encryption = "age"
 	identity = "{{ .chezmoi.homeDir }}/key.txt"
 	recipient = "age1s3ctpj9lafl6qwyvd89sn448us7gdzd53d8yyhsc7zny78c0k4sqerrkze"
 
+[hooks.init.pre]
+	command = "{{ .chezmoi.sourceDir }}/hooks/.init_pre.sh"
+[hooks.update.pre]
+	command = "{{ .chezmoi.sourceDir }}/hooks/.update_pre.sh"
 [hooks.read-source-state.pre]
-	command = "{{ .chezmoi.sourceDir }}/.before-source-state.sh"
+	command = "{{ .chezmoi.sourceDir }}/hooks/.read-source-state_pre.sh"
diff --git a/home/hooks/.init_pre.sh b/home/hooks/.init_pre.sh
new file mode 100755
index 0000000..f4afab5
--- /dev/null
+++ b/home/hooks/.init_pre.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# note: CHEZMOI_UPDATE will be set if this was invoked indirectly by 'chezmoi update --init'
+set -eu
+
+# While key.txt is managed by Chezmoi, it's required for encrypted operations and needed to bootstrap other operations.
+if [ ! -f ~/key.txt ]; then
+    rbw get "key.txt (age)" --field notes >>~/key.txt
+    rbw get "key.txt (age)" --field password >>~/key.txt
+    echo "key.txt bootstrapped"
+fi
diff --git a/home/.before-source-state.sh b/home/hooks/.read-source-state_pre.sh
similarity index 80%
rename from home/.before-source-state.sh
rename to home/hooks/.read-source-state_pre.sh
index 1aa5925..d5e1ec4 100755
--- a/home/.before-source-state.sh
+++ b/home/hooks/.read-source-state_pre.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 set -eu
 
 apt_update() {
@@ -61,18 +61,9 @@ install_inotify() {
     fi
 }
 
-# While key.txt is managed by Chezmoi, it's required for encrypted operations and needed to bootstrap other operations.
-provide_key_txt() {
-    if [ ! -f "~/key.txt" ]; then
-        rbw get "key.txt (age)" --field notes >~/key.txt
-        rbw get "key.txt (age)" --field password >~/key.txt
-    fi
-}
-
 install_inotify
 install_age
 install_cargo_binstall
 install_rbw
 rbw login
 rbw sync
-provide_key_txt
diff --git a/home/hooks/.update_pre.sh b/home/hooks/.update_pre.sh
new file mode 100755
index 0000000..1304e4a
--- /dev/null
+++ b/home/hooks/.update_pre.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# chezmoi update --init does not invoke the 'hooks.init.pre' hook, so we do it ourselves
+if grep -q 'init' <<<$CHEZMOI_ARGS; then
+    # CHEZMOI_UPDATE is just a hint in case we need to know if we're updating
+    CHEZMOI_UPDATE=1 $(dirname $0)/.init_pre.sh
+fi